0

I try to configure 389ds LDAP server. I need 389ds LDAP server only for tests, I do NOT configure any production environment. I use 389ds/dirsrv docker image. I added user01 user using ldapmodify command. The problem is that user1 has not get any rights. user01 cannot get himself using ldapsearch commnad.

cn=Directory Manager:

ldapsearch -x -H ldap://localhost:3389 -D "cn=Directory Manager" -w dupa -LLL -b "cn=user01,ou=People,dc=example,dc=org" -s base objectclass=*
dn: cn=user01,ou=People,dc=example,dc=org
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: shadowAccount
objectClass: posixAccount
objectClass: person
objectClass: top
cn: user01
gidNumber: 1000
homeDirectory: /home/user01
sn: Bar1
uid: user01
uidNumber: 1000
shadowLastChange: 19711
userPassword:: e1BCS0RGMi1TSEE1MTJ9MTAwMDAkR0NySUE4TXRkdGhtTlhMUHF2dmErMG1iQ3p
 Hd2FDWDUkZUVtZnRRd2o3MG8xeEl5bFNVRFJIaEJHTkdxcDVBVWIrTjdEOFF5RUFjZGpxNFpMa2Z3
 dm45MElrK1hFc3A3eGxVZDEvUGkvVEpKbThTYjh5eEN1alE9PQ==

cn=user01,ou=People,dc=example,dc=org:

ldapsearch -x -H ldap://localhost:3389 -D "cn=user01,ou=People,dc=example,dc=org" -w password1 -b "cn=user01,ou=People,dc=example,dc=org" -s base objectclass=*
# extended LDIF
#
# LDAPv3
# base <cn=user01,ou=People,dc=example,dc=org> with scope baseObject
# filter: objectclass=*
# requesting: ALL
#

# search result
search: 2
result: 0 Success

# numResponses: 1

I would like that user01 could see himself. How to fix it?

1 Answer 1

1

You may need to add the permission to read a user with an according aci. e.g.:

Create the file: modify_acis.ldif

dn: ou=people,dc=your,dc=server,dc=com
changetype: modify
add: aci
aci: (targetattr="*")(version 3.0; acl "Self Read Access"; allow (read, search, compare) userdn="ldap:///self";)

Apply with:
ldapmodify -x -D "cn=Directory Manager" -W -f modify_acis.ldif

What to be read etc, you should consider carefully. E.g. the password hash should not be readable unless the users should get the permissions to reset their pw .

2
  • It works, thank you. Is there any other way to manage rights? I got access to some remote test environment to see how it works and try to reproduce it in my test environment and I cannot find any ACI there. I do not know how this remote environment works.
    – Mariusz
    Jan 2 at 17:47
  • Without any further information I can only give general tips: If you have access as the Directory Manager, you can read out the config with: ldapsearch -x -LLL -H ldap://YOUR-SERVER -D "cn=Directory Manager" -W -b "cn=config" "(objectClass=nsslapdConfig)" "*". And the acis: ldapsearch -x -LLL -H ldap://YOUR-SERVER -D "cn=Directory Manager" -W -b "dc=ekp,dc=physik,dc=uni-karlsruhe,dc=de" -s sub "(aci=*)" aci If not, this is not possible (at least to my knowledge). Or alternatively try: manpages.debian.org/bookworm/shelldap/shelldap.1p.en.html which is a really cool tool! Jan 3 at 15:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .