I've been trying to no avail to get this to work - I have a couple of users
that I want to be able to bind via simple LDAP over TLS but only see their own
entry.
I've been playing with Roles, Privileges and Permissions but I can't get this
to work.
One of the parts I've seen in some online documentation says to create a normal
permissions, with read search and compare rights, and use an "Extra Target
Filter" of "(uid=${user})".
Despite assigning this to a Privilege and a Role, and giving only that role to
an account, that account can still read everyone else's entries and attributes.
Is there any way to make this work?
This is my permission entry:
# ipa permission-show "Only access self"
Permission name: Only access self
Granted rights: read, search, compare
Effective attributes: cn, createtimestamp, employeetype, entryusn, givenname,
homedirectory, loginshell, mail,
memberof, mobile, modifytimestamp, objectclass, ou, sn,
title, uid, uidnumber,
usercertificate
Bind rule type: permission
Subtree: cn=users,cn=accounts,dc=ipa,dc=roadtech,dc=internal
Extra target filter: (uid=${user})
Target DN: cn=users,cn=accounts,dc=ipa,dc=roadtech,dc=internal
Type: user
Permission flags: SYSTEM, V2
Granted to Privilege: restricted_user
Indirect Member of roles: Only self
Now what I'm unsure of is the extra filter, does this variable "$user" even
exist? I can't find anything in the IPA docs about variables that can be used
in filters. I've also tried changing $user to the actual UID of the user I'm
working with and it still had no effect, the user can still see everything
(unprivileged attributes only but all the rest are there).
--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
