Skip to content
Snippets Groups Projects
Commit b06a0261 authored by Howard Chu's avatar Howard Chu
Browse files

Revert "(ITS#7341) Ordered list error in overlays.sdf and attr in access-control.sdf" 

This reverts commit dc9fcccc.
The commit appears to have come from an out of date branch.
parent e3098183
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
doc/guide/admin/access-control.sdf
+ 12
− 11
View file @ b06a0261
# $OpenLDAP: pkg/openldap-guide/admin/access-control.sdf,v 1.9 2009-06-19 19:12:12 ghenry Exp $
# Copyright 1999-2009 The OpenLDAP Foundation, All Rights Reserved.
# $OpenLDAP$
# Copyright 1999-2012 The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
H1: Access Control
......@@ -25,8 +25,9 @@ rights (i.e. auth, search, compare, read and write) on everything and anything.
As a consequence, it's useless (and results in a performance penalty) to explicitly
list the {{rootdn}} among the {{<by>}} clauses.
The following sections will describe Access Control Lists in more details and
follow with some examples and recommendations.
The following sections will describe Access Control Lists in greater depth and
follow with some examples and recommendations. See {{slapd.access}}(5) for
complete details.
H2: Access Control via Static Configuration
......@@ -326,7 +327,7 @@ attribute and various {{EX:<who>}} selectors.
> access to dn.subtree="dc=example,dc=com" attrs=homePhone
> by self write
> by dn.children="dc=example,dc=com" search
> by peername.regex=IP:10\..+ read
> by peername.regex=IP=10\..+ read
> access to dn.subtree="dc=example,dc=com"
> by self write
> by dn.children="dc=example,dc=com" search
......@@ -664,7 +665,7 @@ attribute and various {{EX:<who>}} selectors.
> olcAccess: to dn.subtree="dc=example,dc=com" attrs=homePhone
> by self write
> by dn.children=dc=example,dc=com" search
> by peername.regex=IP:10\..+ read
> by peername.regex=IP=10\..+ read
> olcAccess: to dn.subtree="dc=example,dc=com"
> by self write
> by dn.children="dc=example,dc=com" search
......@@ -780,7 +781,7 @@ H3: Basic ACLs
Generally one should start with some basic ACLs such as:
> access to attrs=userPassword
> access to attr=userPassword
> by self =xw
> by anonymous auth
> by * none
......@@ -826,7 +827,7 @@ This ACL grants read permissions to authenticated users while denying others
H3: Controlling rootdn access
You could specify the {{rootdn}} in {{slapd.conf}}(5) or {[slapd.d}} without
You could specify the {{rootdn}} in {{slapd.conf}}(5) or {{slapd.d}} without
specifying a {{rootpw}}. Then you have to add an actual directory entry with
the same dn, e.g.:
......@@ -876,7 +877,7 @@ One can then grant access to the members of this this group by adding appropriat
> by group.exact="cn=Administrators,dc=example,dc=com" write
> by * auth
Like by {[dn}} clauses, one can also use {{expand}} to expand the group name
Like by {{dn}} clauses, one can also use {{expand}} to expand the group name
based upon the regular expression matching of the target, that is, the to {{dn.regex}}).
For instance,
......@@ -1153,7 +1154,7 @@ To get what we wanted the file has to read:
The general rule is: "special access rules first, generic access rules last"
See also {{slapd.access}}(8), loglevel 128 and {{slapacl}}(8) for debugging
See also {{slapd.access}}(5), loglevel 128 and {{slapacl}}(8) for debugging
information.
......@@ -1322,7 +1323,7 @@ The end result is that when Jane accesses John's entry, she will be granted
write access to the specified attributes. Better yet, this will happen to any
entry she accesses which has Mary as the manager.
This is all cool and nice, but perhaps gives to much power to secretaries. Maybe we need to further
This is all cool and nice, but perhaps gives too much power to secretaries. Maybe we need to further
restrict it. For example, let's only allow executive secretaries to have this power:
> access to dn.exact="uid=john,ou=people,dc=example,dc=com"
......
doc/guide/admin/overlays.sdf
+ 57
− 28
View file @ b06a0261
# $OpenLDAP: pkg/openldap-guide/admin/overlays.sdf,v 1.47 2009-12-15 12:09:35 ghenry Exp $
# Copyright 2007-2009 The OpenLDAP Foundation, All Rights Reserved.
# $OpenLDAP$
# Copyright 2007-2012 The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
H1: Overlays
......@@ -326,7 +326,7 @@ H3: Read-Back of Chained Modifications
Occasionally, applications want to read back the data that they just wrote.
If a modification requested to a shadow server was silently chained to its
producer, an immediate read could result in receiving data not yet synchronized.
provider, an immediate read could result in receiving data not yet synchronized.
In those cases, clients should use the {{B:dontusecopy}} control to ensure
they are directed to the authoritative source for that piece of data.
......@@ -555,7 +555,7 @@ In {{F:slapd.conf}}(5):
> ...
> overlay dynlist
> dynlist-attrset groupOfURLs labeledURI member
+
+Note: We must include the {{F:dyngroup.schema}} file that defines the
+{{F:groupOfURLs}} objectClass used in this example.
......@@ -613,8 +613,7 @@ specific database. For example, with the following minimal slapd.conf:
> include /usr/share/openldap/schema/core.schema
> include /usr/share/openldap/schema/cosine.schema
> modulepath /usr/lib/openldap
> moduleload memberof.la
>
> authz-regexp "gidNumber=0\\\+uidNumber=0,cn=peercred,cn=external,cn=auth"
> "cn=Manager,dc=example,dc=com"
> database bdb
......@@ -725,13 +724,13 @@ design and implementation details.
H3: Proxy Cache Configuration
The cache configuration specific directives described below must
appear after a {{EX:overlay proxycache}} directive within a
{{EX:"database meta"}} or {{EX:database ldap}} section of
appear after a {{EX:overlay pcache}} directive within a
{{EX:"database meta"}} or {{EX:"database ldap"}} section of
the server's {{slapd.conf}}(5) file.
H4: Setting cache parameters
> proxyCache <DB> <maxentries> <nattrsets> <entrylimit> <period>
> pcache <DB> <maxentries> <nattrsets> <entrylimit> <period>
This directive enables proxy caching and sets general cache
parameters. The <DB> parameter specifies which underlying database
......@@ -739,7 +738,7 @@ is to be used to hold cached entries. It should be set to
{{EX:bdb}} or {{EX:hdb}}. The <maxentries> parameter specifies the
total number of entries which may be held in the cache. The
<nattrsets> parameter specifies the total number of attribute sets
(as specified by the {{EX:proxyAttrSet}} directive) that may be
(as specified by the {{EX:pcacheAttrset}} directive) that may be
defined. The <entrylimit> parameter specifies the maximum number of
entries in a cacheable query. The <period> specifies the consistency
check period (in seconds). In each period, queries with expired
......@@ -747,16 +746,16 @@ TTLs are removed.
H4: Defining attribute sets
> proxyAttrset <index> <attrs...>
> pcacheAttrset <index> <attrs...>
Used to associate a set of attributes to an index. Each attribute
set is associated with an index number from 0 to <numattrsets>-1.
These indices are used by the proxyTemplate directive to define
These indices are used by the pcacheTemplate directive to define
cacheable templates.
H4: Specifying cacheable templates
> proxyTemplate <prototype_string> <attrset_index> <TTL>
> pcacheTemplate <prototype_string> <attrset_index> <TTL>
Specifies a cacheable template and the "time to live" (in sec) <TTL>
for queries belonging to the template. A template is described by
......@@ -764,7 +763,7 @@ its prototype filter string and set of required attributes identified
by <attrset_index>.
H4: Example
H4: Example for slapd.conf
An example {{slapd.conf}}(5) database section for a caching server
which proxies for the {{EX:"dc=example,dc=com"}} subtree held
......@@ -774,27 +773,60 @@ at server {{EX:ldap.example.com}}.
> suffix "dc=example,dc=com"
> rootdn "dc=example,dc=com"
> uri ldap://ldap.example.com/
> overlay proxycache
> proxycache bdb 100000 1 1000 100
> proxyAttrset 0 mail postaladdress telephonenumber
> proxyTemplate (sn=) 0 3600
> proxyTemplate (&(sn=)(givenName=)) 0 3600
> proxyTemplate (&(departmentNumber=)(secretary=*)) 0 3600
> overlay pcache
> pcache bdb 100000 1 1000 100
> pcacheAttrset 0 mail postaladdress telephonenumber
> pcacheTemplate (sn=) 0 3600
> pcacheTemplate (&(sn=)(givenName=)) 0 3600
> pcacheTemplate (&(departmentNumber=)(secretary=*)) 0 3600
>
> cachesize 20
> directory ./testrun/db.2.a
> index objectClass eq
> index cn,sn,uid,mail pres,eq,sub
H4: Example for slapd-config
The same example as a LDIF file for back-config for a caching server
which proxies for the {{EX:"dc=example,dc=com"}} subtree held
at server {{EX:ldap.example.com}}.
> dn: olcDatabase={2}ldap
> objectClass: olcDatabaseConfig
> objectClass: olcLDAPConfig
> olcDatabase: {2}ldap
> olcSuffix: dc=example,dc=com
> olcRootDN: dc=example,dc=com
> olcDbURI: "ldap://ldap.example.com"
>
> dn: olcOverlay={0}pcache
> objectClass: olcOverlayConfig
> objectClass: olcPcacheConfig
> olcOverlay: {0}pcache
> olcPcache: bdb 100000 1 1000 100
> olcPcacheAttrset: 0 mail postalAddress telephoneNumber
> olcPcacheTemplate: "(sn=)" 0 3600 0 0 0
> olcPcacheTemplate: "(&(sn=)(givenName=))" 0 3600 0 0 0
> olcPcacheTemplate: "(&(departmentNumber=)(secretary=))" 0 3600
>
> dn: olcDatabase={0}hdb
> objectClass: olcHdbConfig
> objectClass: olcPcacheDatabase
> olcDatabase: {0}hdb
> olcDbDirectory: ./testrun/db.2.a
> olcDbCacheSize: 20
> olcDbIndex: objectClass eq
> olcDbIndex: cn,sn,uid,mail pres,eq,sub
H5: Cacheable Queries
A LDAP search query is cacheable when its filter matches one of the
templates as defined in the "proxyTemplate" statements and when it references
templates as defined in the "pcacheTemplate" statements and when it references
only the attributes specified in the corresponding attribute set.
In the example above the attribute set number 0 defines that only the
attributes: {{EX:mail postaladdress telephonenumber}} are cached for the following
proxyTemplates.
pcacheTemplates.
H5: Examples:
......@@ -802,7 +834,7 @@ H5: Examples:
> Attrs: mail telephoneNumber
is cacheable, because it matches the template {{EX:(&(sn=)(givenName=))}} and its
attributes are contained in proxyAttrset 0.
attributes are contained in pcacheAttrset 0.
> Filter: (&(sn=Richard*)(telephoneNumber))
> Attrs: givenName
......@@ -1010,6 +1042,8 @@ If we removed all users from the directory who are a member of this group, then
would be a single member in the group: {{F:cn=admin,dc=example,dc=com}}. This is the
{{F:refint_nothing}} parameter kicking into action so that the schema is not violated.
The {{rootdn}} must be set for the database as refint runs as the {{rootdn}} to gain access to
make its updates. The {{rootpw}} does not need to be set.
H3: Further Information
......@@ -1175,11 +1209,6 @@ First we configure the overlay in the normal manner:
> pidfile ./slapd.pid
> argsfile ./slapd.args
>
> modulepath /usr/local/libexec/openldap
> moduleload back_bdb.la
> moduleload back_ldap.la
> moduleload translucent.la
>
> database bdb
> suffix "dc=suretecsystems,dc=com"
> rootdn "cn=trans,dc=suretecsystems,dc=com"
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment