openldap 授予組對子樹的寫訪問權限

我有

dn: ou=people,dc=example,dc=com
objectClass: organizationalUnit
ou: people

和它的管理員組：

dn: cn=people-admins,ou=groups,dc=example,dc=com
objectClass: groupOfUniqueNames
cn: admins of people group
uniqueMember: uid=admin1,ou=people,dc=example,dc=com

我添加了這樣的規則以允許people-admins添加/刪除/修改people組中的使用者

dn: olcDatabase={1}hdb,cn=config
changetype: modify
delete: olcAccess
-
add: olcAccess
olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,dc=example,dc=com" write by anonymous auth by * none
olcAccess: to dn.one="ou=people,dc=example,dc=com" by group.exact=cn=people-admins,ou=groups,dc=example,dc=com write by self write by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: to dn.base="ou=people,dc=example,dc=com" by group.exact=cn=people-admins,ou=groups,dc=example,dc=com write by self write by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: to dn.children="ou=people,dc=example,dc=com" by group.exact=cn=people-admins,ou=groups,dc=example,dc=com write by self write by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: to dn.subtree="ou=people,dc=example,dc=com" by group.exact=cn=people-admins,ou=groups,dc=example,dc=com write by self write by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: to * by self write by dn="cn=admin,dc=example,dc=com" write by * none

然後我嘗試people使用 admin1 的憑據將新使用者添加到組中，並得到了這個：

ldapadd -x -H ldap://127.0.0.1:3000/  -D "uid=admin1,ou=people,dc=example,dc=com" -W
dn: uid=test1,ou=people,dc=example,dc=com
objectClass: inetOrgPerson
uid: test1
sn: test
givenName: test1
cn: test test1
displayName: Test1
userPassword: test1
adding new entry "uid=test1,ou=people,dc=example,dc=com"
ldap_add: Insufficient access (50)
       additional info: no write access to parent

這裡類似的問題，但它收到錯誤的答案，因為dn.entry在openldap中不存在。

問題是group.exact不能與groupOfUniqueNames. 我通過更改此規則解決了它：

by group.exact=cn=people-admins,ou=groups,dc=example,dc=com write

這條規則：

by group/groupOfUniqueNames/uniqueMember=cn=people-admins,ou=groups,dc=example,dc=com write

如果您剛剛開始，我建議切換到 usinggroupOfNames而不是groupOfUniqueNames.

大多數與 OpenLDAP 互動以獲得組成員身份的系統預設需要 groupOfNames，包括 OpenLDAP 本身。雖然它們通常可以修改為使用 groupOfUniqueNames/uniqueMember（例如，或者您自己在 OpenLDAP 的 olcAccess 中使用），但這將使您不必調整預設值。sssd-ldap ldap_group_member

---

distinguishedNameMatch, used bymember和uniqueMemberMatchused by之間有區別uniqueMember，但前者通常就足夠了。

$ ldapadd <<EOF
dn: cn=testgroup,ou=groups,dc=example,dc=com
> objectclass: groupofnames
> member: uid=testuser,ou=people,dc=example,dc=com
> member: uid=testuser,ou=people,dc=example,dc=com
> EOF
SASL/GSSAPI authentication started
SASL username: self@EXAMPLE.COM
SASL SSF: 56
SASL data security layer installed.
adding new entry "cn=testgroup,ou=groups,dc=example,dc=com"
ldap_add: Type or value exists (20)
   additional info: member: value #0 provided more than once



$ ldapsearch cn=testgroup
dn: cn=testgroup,ou=groups,dc=example,dc=com
objectClass: groupOfNames
objectClass: posixGroup
cn: testgroup
gidNumber: 12345
member: uid=testuser,ou=people,dc=example,dc=com

$ ldapmodify <<EOF
dn: cn=testgroup,ou=groups,dc=example,dc=com
add: member
member: uid=testuser,ou=people,dc=example,dc=com
EOF

SASL/GSSAPI authentication started
SASL username: self@EXAMPLE.COM
SASL SSF: 56
SASL data security layer installed.
modifying entry "cn=testgroup,ou=groups,dc=example,dc=com"
ldap_modify: Type or value exists (20)
   additional info: modify/add: member: value #0 already exists

引用自：https://serverfault.com/questions/770553