Question

我无法弄清楚为什么ldapmodify不会接受我的grantuserall2.ldif 我想要ou = service，uid = dovecot可以读取userPassword。不幸的是ldapmodify甚至不接受简单的acl：D 我遇到了错误：

ldapmodify -h localhost -p 389 -D "cn=admin,dc=example,dc=com" -w ****** -f /etc/ldap/grantuserall2.ldif
modifying entry "olcDatabase{1}hdb,cn=config"
ldap_modify: Invalid DN syntax (34)
additional info: invalid DN

grantuserall2.ldif:
dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {3}to *
    by self write
    by users read
    by * none

ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -w ******  olcDatabase={1}hdb
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=example,dc=com
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou
 s auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by * re
 ad
olcLastMod: TRUE
olcRootDN: cn=admin,dc=example,dc=com
olcRootPW: {SSHA}***********************************
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcDbIndex: uid pres,eq
olcDbIndex: cn,sn,mail pres,eq,approx,sub
olcDbIndex: objectClass eq

我的DIT与此类似：http://i.stack.imgur.com/GcAPL.png

我会批评任何帮助。晚安^^

Answer 1

解决方案是在dn选择中有一个=。

例如，而不是：

grantuserall2.ldif:
dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {3}to *
    by self write
    by users read
    by * none

做的：

grantuserall2.ldif:
dn: olcDatabase={1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {3}to *
    by self write
    by users read
    by * none

Openldap ldapmodify acl无效DN

1 个答案: