[389-users] ACI Confusion (New to 389 Came from OL):

[John A. Sullivan III]

On Sat, 2009-07-25 at 17:00 -0500, Anthony Messina wrote:
> On Saturday 25 July 2009 03:54:57 pm John A. Sullivan III wrote:
> > Hmm . . . I've never used an ACI swapping attributes as your are (CN for
> > UID) but I would think it should work.  Out of curiosity, if you set the
> > user's CN = UID and then rewrite the ACI to be ldap://($dn),....., does
> > it work?
> 
> Thanks for giving a good stab at this, John.  I tried just changing the "cn" 
> for a user without changing the dn to read cn=amessina... (currently, 
> eGroupWare expects it to read uid=amessina...)  That did not work.
> 
> Is it to be expected, then, that one is not able to do something like:
> 
> target = ldap://some_attr=($dn)...
> 
> userdn = ldap://some_other_attr=($dn)... or
> userdn = ldap://some_other_attr=[$dn]...
> ???
> 
> In short, does the ($dn) macro in the target HAVE TO match the whole portion 
> between the commas, like "uid=amessina" rather than just "amessina":
> 
> Can it do:
> target = ldap://cn=($dn),ou=....
> or must it be:
> target = ldap://($dn),ou=...
> 
<snip>
As I mentioned, I've never tried it using just the value and swapping
attributes.  I would expect it would work.  We have used variable
substitution very successfully in some quite complex ACIs.  

(target = "ldap:///($dn),o=internal,dc=ssiservices,dc=biz")(targetattr !
= "sambaLMPassword || sambaNTPassword || userPassword") (version 3.0;acl
"Client Internal Directory Searcher";allow (read,compare,search)(userdn
= "ldap:///uid=*dsearcher, [$dn],o=sysaccounts,dc=ssiservices,dc=biz");)

I would have thought what you were doing would work just as you
described.  The biggest problem we have faced is not being able to use
wildcards in groupdn although we can in userdn.

I can say that using the complete attribute does work as advertised.
Hopefully the gurus will return to the list soon! I'd like to know why
what you have proposed doesn't work.  Good luck - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan at opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society