Linux Networking Cookbook

12.14. Refining Access Controls

Problem

Right now, your directory is read-only for everyone, and read/write for the admin user. Is there a way to allocate access controls more finely?

Solution

Of course there is. Let's start with our simple example DIT, the one with the suffix of dc=alrac, dc=net, and its single second-level ou=people:

	dc=alrac, dc=net

	ou=people

Let's say we have a number of users in people with the following attributes:

	objectClass:
	cn:
	sn:
	uid:
	title:
	jpegPhoto:
	telephoneNumber:
	homePhone:
	homePostalAddress:
	mail:
	description:

It would be nice to let users control some of their own data, such as passwords, email addresses, and telephone numbers. But, not everything: UIDs, titles, CNs, and such should be protected from mischievous users. So, let's take our access controls from Recipe 12.4 and add to them. The new entries are in bold, and our ACLs are now numbered so we can keep track more easily:

	#ACL 1
	access to attrs=userPassword,shadowLastChange
	    by dn="cn=admin,dc=alrac,dc=net" write
	    by anonymous auth
	    by self write
	    by * none

	#ACL 2
	access to attrs=homePostalAddress,homePhone,telephoneNumber,mail
	    by dn="cn=admin,dc=alrac,dc=net" write
	    by self write
	    by * none

	#ACL 3
	access to dn.base="" by * read

	#ACL 3
	access to *
	        by dn="cn=admin,dc=alrac,dc=net" write
	        by * read

Save your changes, run slaptest, and restart slapd; then fire up an LDAP client, and verify that users can make their own changes:

	$ ldapmodify -xD "uid=cschroder,ou=people,dc=alrac,dc=net" -W Enter LDAP Password: ...