<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Verdana,Geneva,sans-serif'>
<p>@ Nikolai, sorry for the delay in getting back with you.</p>
<p>@Jan, nice examples. The only thing I would change is to add a "target" restriction that says what part of the tree the rule is allowed to act upon.</p>
<pre>aci: (target="ldap:///ou=People,dc=example,dc=com") (targetattr = "*")<br /> (version 3.0; acl "Owncloud Bind User"; allow
(read,compare,search) (userdn = "ldap:///uid=owncloud-bind,ou=Special
Users,dc=example,dc=com");)
aci: (target="ldap:///ou=People,dc=example,dc=com") (targetattr = "userPassword")<br /> (version 3.0;acl "Owncloud Bind User";allow(read,search,compare,add,write,selfwrite,delete)<br /> (userdn ="ldap:///uid=owncloud-bind,ou=Special Users,dc=example,dc=com");)</pre>
<p> </p>
<div> </div>
<p>On 2015-01-09 4:34 pm, Jan Kowalsky wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<pre>
Am 29.12.2014 um 04:20 schrieb <a href="mailto:bshaw@vsvinc.com:">bshaw@vsvinc.com:</a></pre>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">Nikolai, The trick is to create an ACI rule that gives the desired permission to your bind user. I'm not near my LDAP server at the moment to work out an example but if you need one, let me know and when I'm next on that system, I'll work it out. Brian Sent from Nine From: Nikolai Maziashvili <<a href="mailto:mlist_kolab@cyclinggeorgian.com">mlist_kolab@cyclinggeorgian.com</a>> Sent: Dec 28, 2014 7:18 PM To: Users Subject: Bind user with rights to change password.</blockquote>
<pre>maybe something like this (unproved):
# add special bind user for owncloud
dn: uid=owncloud-bind,ou=Special Users,dc=example,dc=com
changetype: add
sn: bind
uid: owncloud-bind
objectClass: top
objectClass: person
objectClass: inetorgperson
objectClass: organizationalperson
givenName: owncloud
cn: owncloud bind
userPassword: secret
# allow user to change password in the specific domain
dn: dc=example,dc=com
changetype: modify
add: aci
aci: (targetattr = "*") (version 3.0; acl "Owncloud Bind User"; allow
(read,compare,search) (userdn = "ldap:///uid=owncloud-bind,ou=Special
Users,dc=example,dc=com");)
aci: (targetattr = "userPassword") (version 3.0;acl "Owncloud Bind
User";allow(read,search,compare,add,write,selfwrite,delete)(userdn =
"ldap:///uid=owncloud-bind,ou=Special Users,dc=example,dc=com");)
If you have multiple domains you have to do the last step for every
domain where this bind user should have the ability to change password.
Regards
Jan
_______________________________________________
users mailing list
<a href="mailto:users@lists.kolab.org">users@lists.kolab.org</a>
<a href="https://lists.kolab.org/mailman/listinfo/users">https://lists.kolab.org/mailman/listinfo/users</a>
</pre>
</blockquote>
</body></html>