On 13.08.24 11:17, Ronald Wimmer via FreeIPA-users wrote:
On 13.08.24 10:20, Ronald Wimmer via FreeIPA-users wrote:
As I do not now anything about LDAP users and permissions I would like
to ask for advice in this matter.
I need an LDAP user that is capable of creating users in the staging
area as well as modifying or deleting existing users.
I am aware of how to create a system user
(https://www.freeipa.org/page/HowTo/LDAP ) but I do not know if there
is some kind of permission management (apart from putting the user in
cn=sysaccounts and assigning the right objectclasses).
I started reading about ACIs in Directory Server. Maybe I'll just stick
to using "cn=Directory Manager" for this task...
This is how I think an ACI should look like in order to allow user
creation in the staging area.
(targetattr = "*")
(target = "ldap:///cn=staged
users,cn=accounts,cn=provisioning,dc=linux,dc=mydomain,dc=at")
(version 3.0;
acl "iam add staging users aci";
allow (add)
(userdn =
"ldap:///uid=someadminuser,cn=sysaccounts,cn=etc,dc=example,dc=com";)
;)
So I would need a separate ACI with "allow (all)" for DN:
cn=users,cn=accounts,dc=linux,dc=mydomain,dc=at to allow modification of
existing users, right?
--
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
