我一直在尝试将此dlif应用于我的openldap服务器：
$ cat acl.ldif
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {3}to dn.exact="cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,dc=com" attrs="ipServicePort,description" by dn="mail=itops@thedomain.com,ou=people,dc=thedomain,dc=com" write by * read
我认为这应该允许使用DN "mail=itops@thedomain.com,ou=people,dc=thedomain,dc=com"的用户更新"cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,dc=com"上的属性ipServicePort和说明
这似乎很适用：
$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f acl.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}hdb,cn=config"
当我搜索它时，我可以找到更新的条目：
$ sudo ldapsearch -Y EXTERNAL -H ldapi:// -b cn=config 'olcDatabase={1}hdb'
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <cn=config> with scope subtree
# filter: olcDatabase={1}hdb
# requesting: ALL
#
# {1}hdb, config
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=thedomain,dc=com
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou
s auth by dn="cn=admin,dc=domain,dc=ie,dc=aws,dc=thedomain,dc=net" write by * n
one
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=admin,dc=domain,dc=ie,dc=aws,dc=thedomain,dc=net" w
rite by * read
olcAccess: {3}to dn.exact="cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,
dc=com" attrs="ipServicePort,description" by dn="mail=itops@thedomain.com,ou=p
eople,dc=thedomain,dc=com" write by * read
olcLastMod: TRUE
olcRootDN: cn=admin,dc=thedomain,dc=com
olcRootPW: {SSHA}HASHEDPW
olcSyncrepl: {0}rid=003 provider=ldap://ldap.city.thedomain.com binddn="cn
=admin,dc=thedomain,dc=com" bindmethod=simple credentials=Cju8MJZhegnEgKp2nU s
earchbase="dc=thedomain,dc=com" type=refreshAndPersist interval=00:00:00:10 re
try="5 5 300 5" timeout=1
olcSyncrepl: {1}rid=004 provider=ldap://ldap1.domain.ie.aws.thedomain.net binddn
="cn=admin,dc=thedomain,dc=com" bindmethod=simple credentials=Cju8MJZhegnEgKp2
nU searchbase="dc=thedomain,dc=com" type=refreshAndPersist interval=00:00:00:1
0 retry="5 5 300 5" timeout=1
olcMirrorMode: TRUE
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcDbIndex: objectClass eq
olcDbIndex: entryCSN eq
olcDbIndex: entryUUID eq
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
但是，当我尝试使用这些凭据进行更改时，它仍然会失败：
$ cat /tmp/modify.ldif
dn: cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,dc=com
changetype: modify
replace: ipServicePort
ipServicePort: 1485176342
dn: cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,dc=com
changetype: modify
replace: description
description: Updated by ldap.city.thedomain.com on Mon Jan 23 12:59:02 UTC 2017
运行：
$ ldapmodify -H ldap://localhost -w PASSWORD -D "mail=itops@thedomain.com,ou=people,dc=thedomain,dc=com" -f /tmp/modify.ldif
modifying entry "cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,dc=com"
ldap_modify: Insufficient access (50)
我也试过让我的ACL稍微限制一点，试图理解什么不起作用，我尝试了以下acl.ldif文件：
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {3}to dn="cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,dc=com" attrs="ipServicePort,description" by dn="mail=itops@thedomain.com,ou=people,dc=thedomain,dc=com" write by * read
结果是相同的
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {3}to dn="cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,dc=com" by dn="mail=itops@thedomain.com,ou=people,dc=thedomain,dc=com" write by * read
结果是相同的
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {3}to * by dn="mail=itops@thedomain.com,ou=people,dc=thedomain,dc=com" write by * read
结果是相同的
我唯一没有尝试的东西，因为我希望避免使db这个不安全，即使在测试期间，也是允许*写这条记录，或者*写入所有记录。
我从Apache Directory Studio中获取了我想要允许编辑的记录的dn，它显示了我：
DN: cn=ldap-city-thedomain-com,dc=repl,dc=thedomain,dc=com
我的用户DN来自同一个：
DN: mail=itops@thedomain.com,ou=people,dc=thedomain,dc=com
我确信我做的事情显然很愚蠢，因为我对ldap的了解很差，阅读文档对我来说很痛苦。我希望有人可以发现我明显的错误并建议更正，因为经过大量的修补后我无法看清我做错了什么。
答案 0 :(得分：0)
感谢#openldap IRC中的JoBbZ。这对我来说是一个简单的误解。订单在ACL规则中很重要。 LDAP将停止查看第一场比赛，因此我需要将我的olcAccess保存为2而不是3