dataset/seed/openldap/templates/config_acl.ldif

61 lines
1.9 KiB
Text
Raw Normal View History

2022-07-07 09:37:49 +02:00
%set %%name_family = 'gnunux'
2022-05-04 10:29:03 +02:00
%set %%dns = {}
2022-06-24 19:00:16 +02:00
%set %%groups = []
2022-07-07 09:37:49 +02:00
%%groups.append('cn=remote_test0,' + %%ldapclient_base_dn)%slurp
%%groups.append('cn=remote_test1,' + %%ldapclient_base_dn)%slurp
%%groups.append('cn=remote_test2,' + %%ldapclient_base_dn)%slurp
%%dns.setdefault(None, []).append(('cn=remote_test0,' + %%ldapclient_base_dn, 'read'))%slurp
%%dns.setdefault('all', []).append(('cn=remote_test1,' + %%ldapclient_base_dn, 'read'))%slurp
%%dns.setdefault(%%name_family, []).append(('cn=remote_test2,' + %%ldapclient_base_dn, 'read'))%slurp
2022-05-04 10:29:03 +02:00
%for %%remote in %%accounts.remotes
%set %%name = %%normalize_family(%%remote)
%set %%family = %%accounts['remote_' + %%name]['family_' + %%name]
2022-06-24 19:00:16 +02:00
%%groups.append(%%accounts['remote_' + %%name]['dn_' + %%name])%slurp
2022-07-07 09:37:49 +02:00
%if %%accounts['remote_' + %%name]['read_only_' + %%name]
%set %%right = 'read'
%else
%set %%right = 'write'
%end if
%%dns.setdefault(%%family, []).append((%%accounts['remote_' + %%name]['dn_' + %%name], %%right))%slurp
2022-05-04 10:29:03 +02:00
%end for
2022-03-08 19:42:28 +01:00
dn: olcDatabase={2}mdb,cn=config
changetype:modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword
by self write
by anonymous auth
by * none
2022-06-26 19:33:44 +02:00
olcAccess: {1}to dn.subtree="%%ldap_group_dn"
2022-06-24 19:00:16 +02:00
%for group in %%groups
by dn="%%group" read
%end for
by * none
%set %%aclidx = 2
2022-05-04 10:29:03 +02:00
%for %%family, %%remotes in %%dns.items()
2022-05-07 08:11:18 +02:00
%if %%family == 'all'
2022-07-07 09:37:49 +02:00
%continue
2022-05-07 08:11:18 +02:00
%end if
2022-07-07 09:37:49 +02:00
olcAccess: {%%aclidx}to dn.subtree="%%calc_ldapclient_base_dn(%%ldapclient_base_dn, %%family)"
2022-05-04 10:29:03 +02:00
by self read
%for %%remote in %%remotes
2022-07-07 09:37:49 +02:00
by dn="%%remote[0]" %%remote[1]
2022-05-04 10:29:03 +02:00
%end for
2022-07-07 09:37:49 +02:00
%if %%family != 'all' and 'all' in %%dns
%for %%remote in %%dns['all']
by dn="%%remote[0]" %%remote[1]
%end for
%end if
%set %%aclidx += 1
%if %%family != 'all'
2022-03-08 19:42:28 +01:00
by * none
2022-07-07 09:37:49 +02:00
%end if
2022-05-04 10:29:03 +02:00
%end for
2022-07-07 09:37:49 +02:00
%if 'all' in %%dns
olcAccess: {%%aclidx}to dn.subtree="%%ldap_account_dn"
by self read
%for %%remote in %%dns['all']
by dn="%%remote[0]" %%remote[1]
%end for
by * none
%end if