Como mostrado na documentação (artigo 8.2.5), estou tentando restringir o acesso para atributos de dn.subtree="ou=accounts,dc=domain,dc=local" para dn="cn=addrbook,ou=services,dc=domain,dc=local" , mas não há acesso a atributos especificados para dn="cn=addrbook,ou=services,dc=domain,dc=local"
root@metalmachine:~# ldapsearch -D "cn=addrbook,ou=services,dc=domain,dc=local" -W -b "ou=accounts,dc=domain,dc=local" mail
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <ou=accounts,dc=domain,dc=local> with scope subtree
# filter: (objectclass=*)
# requesting: mail
#
# search result
search: 2
result: 32 No such object
# numResponses: 1
Aqui estão duas diretivas de acesso para dn.subtree="ou=accounts,dc=domain,dc=local"
access to dn.subtree="ou=accounts,dc=domain,dc=local" attrs=uid,mail,cn,gn,sn,displayName
by dn="cn=addrbook,ou=services,dc=domain,dc=local" read
by dn="cn=dovecot,ou=services,dc=domain,dc=local" read
access to dn.subtree="ou=accounts,dc=domain,dc=local"
by dn="cn=dovecot,ou=services,dc=domain,dc=local" read
by anonymous auth
by self read
by * none
Tudo funciona bem para dn="cn=dovecot,ou=services,dc=domain,dc=local" .
Eu encontrei uma solução:
access to dn.children="ou=accounts,dc=domain,dc=local" attrs=uid,mail,cn,gn,sn,displayName
by dn="cn=addrbook,ou=services,dc=domain,dc=local" read
access to dn.subtree="ou=accounts,dc=domain,dc=local"
by dn="cn=addrbook,ou=services,dc=domain,dc=local" search
by dn="cn=dovecot,ou=services,dc=domain,dc=local" read
by anonymous auth
by self read
by * none