what ACLs for OpenLDAP

[LaneaLucy]

i try to get the portal running with openldap but i have problems setting the right acls for it.
anyone have example acl config with minimal permissions from slapd.conf?
thx

[markus-96]

the user that you specify in $ldap_binddn needs at least read and search permission in the ou that you specify in $ldap_base on the attributes objectClass and uid. If you want to use $who_change_password="user", you have to give the users the self-write permission on the attribute userPassword. If it is set to "manager", the user you specify in $ldap_binddn also needs the write permission on this attribute.

This is assuming that your user-accounts are using uid as specifier of the account, and also that your users use the objectClass person. This is not suited for an AD setup.

The permissions you have to set up for SSP are very individual for each setup. Because of that, there is not one solution that fits all.

[davidcoutadeur]

Hello,

You can give a look at OpenLDAP-LTB configuration template here:

https://github.com/ltb-project/slapd-cli/blob/c58ced674092e6003d8f814d982fa875097dc5ae/config-template-2.5.ldif#L264

Especially the userPassword line, giving write permission to each user on his own entry, and giving the same permission to the members of a group called cn=admin

Regards