On Feb 15, 2011, at 14:02 , Rob Crittenden wrote:

Peter Doherty wrote:
Hello,  I'm running Fedora 14 and freeipa 1.2.2-6

Can I create a new cn/nsContainer (cn=subgroup,dc=example,dc=com)
and then create an account that can edit that cn as much as they want,
but can't edit the other ones (ie: accounts, groups...)?
Any pointers to documentation would be useful. Unfortunately I'm not
100% clear on my terminology, so google searches are leading me a bit

What would you put into this container?

389-ds certainly supports doing this, depending on what exactly you want to do IPA may or may not support it. For example, we look for a type of entry only within a given container, so you can't put users into another location.


The first thing I'm looking to do with it is have a web server that has account information stored in LDAP, and to allow users to to ldap authentication. The users logging into the web server would be different from the posix groups that are managed by FreeIPA. I want to replace htaccess and htpasswd files and use LDAP instead. It seems like I could create a subsection in LDAP and set up apache to bind and auth against that. But I also want a seperate ldap admin account that can only edit this section, and not the rest of the FreeIPA data.


Freeipa-users mailing list

Reply via email to