![访问控制列表](https://linux22.com/image/736378/%E8%AE%BF%E9%97%AE%E6%8E%A7%E5%88%B6%E5%88%97%E8%A1%A8.png)
这是我的 ACL,openldap 是 v2.4.4。
访问控制列表
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcAccess
olcAccess: to attrs=userPassword by dn="cn=Manager,dc=ad,dc=pthl,dc=hk" write by anonymous auth by self write by * none
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=Manager,dc=ad,dc=pthl,dc=hk" write by * read
然后我跑
ldapmodify -Y EXTERNAL -H ldapi:/// -f acl.ldif
然后我跑
ldapsearch -x -b ou=people,dc=ad,dc=pthl,dc=hk "(&(objectClass=posixAccount)(uid=someone))" -h 172.16.234.11
返回
# remove some lines
# .....
userPassword:: e1NTSEE1MTJ9MUpGdjcyd0w4aWJZRHd2eHpacVYyb1c4Q1p0Z0JrdDNpdWJDcU9
pVjhmNVQ2QkgzWVNLQnVmNU03bnVwNFB2Q2NiaHR3UGcxOW51VitLMitaUk9WY2JLT0NOMDROWGlG
答案1
阅读官方文档,我找到了根本原因,ACL 是特定于数据库的,要么添加前端,要么添加 HDB。我把它们加错了地方。:(
所以我的最终配置是
dn: olcDatabase=hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: hdb
olcSuffix: dc=ad,dc=pthl,dc=hk
olcRootDN: cn=Manager,dc=ad,dc=pthl,dc=hk
#................
#................
# user itself and Manager write, anonymous bind, other deny
olcAccess: to attrs=userPassword
by self write
by anonymous auth
by dn.base="cn=Manager,dc=ad,dc=pthl,dc=hk" write
by * none
# Manager write, other(both authenticated and anonymous) read.
olcAccess: to *
by dn.base="cn=Manager,dc=ad,dc=pthl,dc=hk" write
by * read
默认的访问控制策略是允许所有客户端读取。无论定义了什么访问控制策略,rootdn 始终被允许对所有内容拥有完全权限(即身份验证、搜索、比较、读取和写入)。
因此,在子句中明确列出 rootdn 是无用的(并且会导致性能下降)。