0

I want to prevent users from accessing anything other than their own data.

I've tried implementing the following simple acl (ldif):

dn: olcDatabase={1}mdb,cn=config
olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none
olcAccess: {1}to attrs=shadowLastChange by self write by self read by * none
olcAccess: {2}to * by self read by * none

When I apply this ldif, I am no longer to query (objectClass=posixAccount). If I change the last acl to to * by * read, the query returns all users.

What am I missing?

0

I found out that in order to access a record, one must have "search" privilege. I changed the ACL to:

dn: olcDatabase={1}mdb,cn=config
olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none
olcAccess: {1}to attrs=shadowLastChange by self write by self read by * none
olcAccess: {2}to * by self read by * search

Using that I was able to query (objectClass=posixAccount) without showing other accounts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.