iulian roman via FreeIPA-users wrote: > Hello everybody, > > I have modified the ipa schema in order to automate Oracle TNS entries. When > I try to add entries with ipa-ldap-updater it works, but not when running > ldapadd (which is used by Oracle). The error i get is : > /bin/ldapadd -h ipaprd04.ipa.example.corp -p 389 -D > "uid=tnsadmin,cn=users,cn=accounts,dc=ipa,dc=example,dc=corp" -W -x -f > orcl1.ldif > Enter LDAP Password: > adding new entry "cn=SP7DEV,cn=oraclecontext,dc=ipa,dc=example,dc=corp" > ldap_add: Insufficient access (50) > additional info: Insufficient 'add' privilege to add the entry > 'cn=SP7DEV,cn=oraclecontext,dc=ipa,dc=example,dc=corp'. > > The permission on the ldap subtree: > ipa permission-show 'write oracle context' > Permission name: write oracle context > Granted rights: write, compare, delete, add, read, search, all > Bind rule type: permission > Subtree: cn=oraclecontext,dc=ipa,dc=example,dc=corp > Target DN: cn=*,cn=oraclecontext,dc=ipa,dc=example,dc=corp > Permission flags: SYSTEM, V2 > Granted to Privilege: tns administrators > > Any ideas/hints would be really appreciated.
Can you provide the output of the permission show with the --raw flag? That will include the actual ACI. I'd do a user-show --all --raw tnsadmin and verify that this permission shows memberofindirect for 'write oracle context'. This permission appears to be pretty straightforward and in line with one that does similar things, System: Add DNS Entries. I assume the rights are spammed because you were trying to get it to work. Don't forget to eventually fine-tune it. rob _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
