tolai del to
tolai del to

Reputation: 1

Openldap user does not inherit write permissions from the group to which he belongs

I have created a group with administration permissions, and 1 wsadmin user, within the group.

dn: cn=admin_group,ou=groups,dc=example,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: admin_group
uniqueMember: uid=wsadmin,ou=users,dc=example,dc=com

These are the assigned permissions:

dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: to attrs=userPassword by self write by anonymous auth by * none
olcAccess: to attrs=shadowLastChange by self write by * read
olcAccess: to dn.base="" by * read
olcAccess: to *
  by group.exact="cn=admin_group,ou=groups,dc=example,dc=com" write
  by * read

We see that it is part of the administrators group:

root@ldapdb:/var/log# ldapsearch -x -LLL -D "cn=admin,dc=example,dc=com" -W -b "ou=groups,dc=example,dc=com" "(cn=admin_group)"
Enter LDAP Password:
dn: cn=admin_group,ou=groups,dc=example,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: admin_group
uniqueMember: uid=wsadmin,ou=users,dc=example,dc=com
description: Grupo Administradores

But, when I try to create a user with the user wsadmin, it tells me that I do not have permissions on users.

root@ldapdb:/home/ubuntu/ldifs# ldapadd -x -D "uid=wsadmin,ou=users,dc=example,dc=com" -W -f admin_sergio.ldif
Enter LDAP Password:
adding new entry "uid=sergio,ou=users,dc=example,dc=com"
ldap_add: Insufficient access (50)
        additional info: no write access to parent

Any idea why the permissions are not being applied?

Thank you!

I tried:

root@ldapdb:/home/ubuntu/ldifs# ldapadd -x -D "uid=wsadmin,ou=users,dc=example,dc=com" -W -f admin_sergio.ldif
Enter LDAP Password:
adding new entry "uid=sergio,ou=users,dc=example,dc=com"
ldap_add: Insufficient access (50)
        additional info: no write access to parent

Upvotes: 0

Views: 54

Answers (0)

Related Questions