2

I have the following query against my directory:

ldapsearch -x -H ldaps://example.com -D "cn=gitlab,ou=Service Accounts,dc=example,dc=com" -w foobar -b "ou=Persons,dc=example,dc=com"

With the following olcAccess I get following results:

dn: olcDatabase={1}mdb,cn=config
olcAccess: {0}to dn.subtree="ou=Persons,dc=example,dc=com" by dn="cn=gitlab,ou=Service Accounts,dc=example,dc=com" read
olcAccess: {1}to attrs=userPassword,shadowLastChange by self =xw by anonymous auth
olcAccess: {2}to * by self read by * none

(rule 1 should be first and it also works like that, but to be sure, I put it down for now)

Result:

# Persons, example.com
dn: ou=Persons,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: Persons

# Hans Wurst, Persons, example.com
dn: cn=Hans Wurst,ou=Persons,dc=example,dc=com
givenName: Hans
sn: Wurst
cn: Hans Wurst
uid: hwurst
userPassword:: <PASSWORDHASH>
uidNumber: 1001
gidNumber: 500
homeDirectory: /home/hwurst
loginShell: /bin/bash
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top

# Carla Kaese, Persons, example.com
dn: cn=Carla Kaese,ou=Persons,dc=example,dc=com
gidNumber: 500
givenName: Carla
homeDirectory: /home/ckaese
loginShell: /bin/bash
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
sn: Kaese
uid: ckaese
uidNumber: 1000
cn: Carla Kaese
userPassword:: <PASSWORDHASH>

Now my goal is to restrict the read access to only some attributes. Thus I change the acls as followes:

dn: olcDatabase={1}mdb,cn=config
olcAccess: {0}to dn.subtree="ou=Persons,dc=example,dc=com" attrs="entry,uid,cn" by dn="cn=gitlab,ou=Service Accounts,dc=example,dc=com" read
olcAccess: {1}to attrs=userPassword,shadowLastChange by self =xw by anonymous auth
olcAccess: {2}to * by self read by * none

I added attrs="entry,uid,cn"

However, the same search now just returns:

# search result
search: 2
result: 0 Success

What am I doing wrong? What am I missing? How can it work?

1

ACLs also affect the authentication step.

When using simple bind (with DN and password) you have to grant auth right to attributes entry and userPassword on the entry to be authenticated.

But AFAICS your last ACL effectively blocks auth access to pseudo-attribute entry. I'd try as last ACL (not tested):

olcAccess: {2}to * by self read by * auth
0
olcAccess: {0}to dn.children="ou=Persons,dc=example,dc=com" attrs=entry,uid,cn,userPassword,mail by dn="cn=gitlab,ou=Service Accounts,dc=example,dc=com" tls_ssf=128 read by * none break
olcAccess: {1}to dn.subtree="ou=Persons,dc=example,dc=com" by dn="cn=gitlab,ou=Service Accounts,dc=example,dc=com" tls_ssf=128 search by * none break

Michael Ströder was close. I needed an extra search. Additionally, the break was necessary. Apparently otherwise the evaluation already stops before the tree can be iterated down to the correct entries.

The tls_ssf=128 is not necessary for this problem, but adds an additional level of security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.