title: OpenLDAP Access Controls link: https://onemoretech.wordpress.com/2004/07/13/openldap-access-controls/ author: lembobro description: post_id: 770 created: 2004/07/13 14:33:00 created_gmt: 2004/07/13 14:33:00 comment_status: open post_name: openldap-access-controls status: publish post_type: post

OpenLDAP Access Controls

At work we don’t use OpenLDAP — yet. But that doesn’t keep me from continuing to experiment with what I consider the best LDAP directory software available today.

Perhaps one of the most daunting tasks of a neophyte OpenLDAP administrator is properly setting up access controls. Although acknowledged by all to be “powerful”, the regex style ACL syntax used by OpenLDAP are a real stumbling block to many. The primary rule to be observed is that once an attribute or dn has had rights to it defined, any subsequent attempt to define access will be ineffective. Failure to define the access of a particular category of user (users, self, anonymous) will result in a denial of access. I found that ordering my rules from specific to general according to logical groupings of dns or attributes to be the most effective strategy. These groupings usually relate to who should be able to see and write to particular attributes or dns. For example, the following control

`

access to attr=uid,c,title
by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=example,dc=com" write
    by users read
    by anonymous read

`

(line continuation character “” used here due to limitations in the formatting of this page, in real life you’d continue on the same lime from “by group” to “write)

will result in title only being writable by admins, and only being readable by authenticated users (write implies read, which also implies search). Users cannot write to the attribute. Everyone else (anonymous) will be unable to see it at all. Note the unintuitive syntax for defining a group’s rights — I have the author of this WLUG Wiki to thank for leading me to the correct string to use. Also note that in an actual access control the “by” line would not contain a line break.

Following is a default set of ACLs I recently implemented in production. Keep in mind that for formatting purposes I’ve put line breaks here. Lines beginning with “access to” or “by” should continue without breaking in an actual slapd.conf file.

`

# Custom access controls - created 12/31/03 by P Lembo
# Read access to root dse by all
access to dn=""
    by * read
# Access by all to schema
access to dn.base="cn=subschema"
    by * read
# Access to monitor by all
access to dn.base="cn=monitor"
    by * read
# Limited access to password
access to attr=userpassword
    by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=company,dc=com" write
    by self write
    by users auth
    by anonymous auth
# Limited access to Posix account attributes
access to attr=uidnumber,gidnumber,homedirectory, loginshell,gecos
    by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=company,dc=com" write
    by self read
# Limited access to Samba account attributes
access to attr=lmpassword,ntpassword,pwdlastset,acctflags,logontime,logofftime,
kickofftime,pwdcanchange,pwdmustchange,smbhome,homedrive,profilepath,
userworkstations,primarygroupid,rid
     by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=company,dc=com" write
    by self read
# User access to organizational attributes
access to attr=o,ou,c,description,uniquemember
    by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=company,dc=com" write
    by users read
# Access to public attributes by all
access to attr=uid,c,title
    by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=company,dc=com" write
    by users read
    by anonymous read
# Self write access to public attributes
access to attr=cn,displayname,sn,givenname,mail,telephonenumber,
facsimiletelephonenumber
    by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=company,dc=com" write
    by self write
    by users read
    by anonymous read
# Self write and limited access to private attributes
access to attr=homephone
    by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=company,dc=com" write
    by self write
    by users read
# Self write and read access to all other attributes
access to *
    by group/groupofuniquenames/uniquemember=
    "cn=Administrators,dc=company,dc=com" write
    by self write
    by users read
    by anonymous read

`

Copyright 2004-2019 Phil Lembo