> On Sun, 2010-02-21 at 13:54 +0100, masar...@aero.polimi.it wrote: >> > On Sun, 2010-02-21 at 13:26 +0100, masar...@aero.polimi.it wrote: >> >> > I am searching for a rule like this: >> >> > >> >> > access >> >> > to "cn=[^,]+,ou=data1,ou=data" attrs="attr1,attr2,attr3" >> >> > by dnattr="owner of node ou=data1,ou=data" write >> >> >> >> Try >> >> >> >> access to dn.children="ou=data1,ou=data" >> >> by set="[ou=data1,ou=data]/owner & user" write >> > >> > Thanks for this hint. The man page for slapd.access currently says >> > "The statement set=<pattern> is undocumented yet". Is there anywhere >> > else a detailed documentation for this? >> >> Yes, it's very well hidden here >> <http://www.openldap.org/faq/data/cache/1133.html> :) Updating >> slapd.access(5) has been on the todo list for long time... > > Thanks, I think I've got the idea and how to use it for my purposes > (those sets are really powerful, my respect to the developers!). > > But unfortunately I don't get it to work, I hope it's only a small > mistake by me: > > This works: > access > to dn.regex=".*,(ou=[^,]+,ou=data)" > by set.expand="user & ([ou=data1,ou=data]/owner)" > > This does NOT work (the owner of ou=dataX,ou=data does NOT get > access to the corresponding child entries): > access > to dn.regex=".*,(ou=[^,]+,ou=data)" > by set.expand="user & ([$1]/owner)" > > (Of course, the first one is not exactly the same as the second one, > because the first one allows access to ALL dataX-subtrees to the owner > of the data1-subtree...) > > But why does the second one not work?
Works for me, so the devil must be in the details. Try with -d acl and see how things expand. p.
