You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@directory.apache.org by Sudheer Kumar <su...@gmail.com> on 2010/06/17 10:57:36 UTC
Warning while loading ACI (Apache DS 1.5.7)
Hi
I get the following warning during startup of Apache ds 1.5.7.
WARN [org.apache.directory.server.core.authz.TupleCache] - Found
accessControlSubentry 'cn=RDSAuthorizationACISubentry,dc=xxx,dc=xx' without
any prescriptiveACI
My ACI is as follows:
# Create a subentry subordinate to "dc=xxx,dc=xx" to grant all operations'
permissions
# to "uid=adminuser,ou=people,dc=xxx,dc=xx", to grant search and compare
permissions
# to all users (even anonymous ones) and to deny search and compare
permissions for
# userPassword attribute to all users.
#
dn: cn=RDSAuthorizationACISubentry,dc=xxx,dc=xx
changetype: add
objectclass: top
objectclass: subentry
objectclass: accessControlSubentry
cn: RDSAuthorizationACISubentry
subtreeSpecification: {}
prescriptiveACI: {
identificationTag "directoryManagerFullAccessACI",
precedence 11,
authenticationLevel simple,
itemOrUserFirst userFirst:
{
userClasses
{
name { "uid=adminuser,ou=people,dc=xxx,dc=com" }
},
userPermissions
{
{
protectedItems
{
entry, allUserAttributeTypesAndValues
},
grantsAndDenials
{
grantAdd, grantDiscloseOnError, grantRead,
grantRemove, grantBrowse, grantExport, grantImport,
grantModify, grantRename, grantReturnDN,
grantCompare, grantFilterMatch, grantInvoke
}
}
}
}
}
prescriptiveACI: {
identificationTag "allUsersACI",
precedence 10,
authenticationLevel none,
itemOrUserFirst userFirst:
{
userClasses
{
allUsers
},
userPermissions
{
{
protectedItems { entry, allUserAttributeTypesAndValues },
grantsAndDenials { grantRead, grantBrowse, grantReturnDN,
grantCompare, grantFilterMatch,
grantDiscloseOnError }
},
{
protectedItems { attributeType { userPassword } },
grantsAndDenials { denyRead, denyCompare, denyFilterMatch }
}
}
}
}
Please let me know if my ACI syntax is wrong or anything else I need to
add/remove?
Note:The same ACI is working with Apache DS 1.5.4.
--
Sudheer Kumar Arimbra
Re: Warning while loading ACI (Apache DS 1.5.7)
Posted by Stefano Gargiulo <ra...@gmail.com>.
Thank you.
So i will keep working with ApacheDS hoping for a fix.
For now i can keep ACI turned off.
I work at GARR, the italian NREN, and i'm preparing a virtual machine to be
distribuited in italian universities and research institutions to help their
system managers to easly deploy an IdP for our SSO federation: it's a
machine with a manageable and secured LDAP server with upon a SAML2 Identity
Provider (Shibboleth2), i already preached for Apache Directory Studio
diffusion that was unknow to them, and much of them now appreciate it a lot
(they was still at stone age with php-ldap-admin, slapadd, ldif manual edit
and openldap all ACLs in a text file (openldap ACL works well but cause the
hostile syntax and the need of reboot the slapd daemon (with risk of
corrupting data on slapd.conf syntax error) just 1% of sysadmins uses them
to cover every sensible attribute)
Much of them are now using Apache Directory Studio to manage openldap ( most
diffused open source LDAP server in the Italian accademic environment), now
i'm going to diffuse also the awesome Apache Directory Server (that due to
his kerberos support is also useful to integrate with legacy SSO system of
some italian research institutions like INFN.
Now, ApacheDS is my religion, i'm sure it will matter.
thank you for innovate! :D
Good work,
Stefano.
2010/7/5 Emmanuel Lecharny <el...@gmail.com>
> On 7/5/10 8:03 PM, Stefano Gargiulo wrote:
>
>> here is a screenshoot with the errors and the ApacheDirectoryStudio window
>> in background where you can see my ACI entry just configured like described
>> in the wiki page you passed in last mail:
>>
>
> Ok, some update :
>
> - the ACI cache we are feeding when you inject a new ACI is discarded when
> the server is shut down, and not restored. This is clearly an error. We are
> currently working on fixing this.
>
>
> I have updated DIRSERVER-1524, you can attach to this issue as a watcher to
> get informed when this will be fixed.
>
> Sorry for the inconvenience...
>
>
>
> --
> Regards,
> Cordialement,
> Emmanuel Lécharny
> www.iktek.com
>
>
Re: Warning while loading ACI (Apache DS 1.5.7)
Posted by Emmanuel Lecharny <el...@gmail.com>.
On 7/5/10 8:03 PM, Stefano Gargiulo wrote:
> here is a screenshoot with the errors and the ApacheDirectoryStudio
> window in background where you can see my ACI entry just configured
> like described in the wiki page you passed in last mail:
Ok, some update :
- the ACI cache we are feeding when you inject a new ACI is discarded
when the server is shut down, and not restored. This is clearly an
error. We are currently working on fixing this.
I have updated DIRSERVER-1524, you can attach to this issue as a watcher
to get informed when this will be fixed.
Sorry for the inconvenience...
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: Warning while loading ACI (Apache DS 1.5.7)
Posted by Stefano Gargiulo <ra...@gmail.com>.
here is a screenshoot with the errors and the ApacheDirectoryStudio
window in background where you can see my ACI entry just configured like
described in the wiki page you passed in last mail:
http://i47.tinypic.com/28mk65z.png
pratical effects: if i leave ACI turned on my users are unable to see
anything in the ldap tree...!
Best regards,
Stefano Gargiulo.
2010/7/5 Emmanuel Lecharny <elecharny@gmail.com
<ma...@gmail.com>>
On 7/5/10 5:54 PM, Stefano Gargiulo wrote:
I also have this warining in 1.5.7 but i'm using the demo ACI
provided in the getting started example:
cn="sevenSeasAuthorizationRequirementsACISubentry"
subtreeSpecification="{}"
prescriptiveACI="{
identificationTag
"directoryManagerFullAccessACI",
precedence 11,
authenticationLevel simple,
itemOrUserFirst userFirst:
{
userClasses
{
name { "cn=Horatio
Nelson,ou=people,o=sevenSeas" }
},
userPermissions
{
{
protectedItems
{
entry, allUserAttributeTypesAndValues
},
grantsAndDenials
{
grantAdd, grantDiscloseOnError,
grantRead,
grantRemove, grantBrowse,
grantExport, grantImport,
grantModify, grantRename, grantReturnDN,
grantCompare, grantFilterMatch,
grantInvoke
}
}
}
}
}"
in my case the aci doesn't loads.. so i'm unable to use ACI in
ApacheDS.
Hmmm... What message do you get ?
The second prescriptiveACI seems to be ok, except that the
'grantDiscloseOnError' element starts on a new line without a
space at first position.
PS. what do you think about JSON for ACI syntax in a next
version of ApacheDS?
here, the syntax is handled by Apache Directory Studio, you don't
even have to manipulate the text itself.
Have a look at the next documentation we are currently rewritting :
https://cwiki.apache.org/confluence/display/DIRxSRVx20/2.5.7.1+Enable+Authenticated+Users+to+Browse+and+Read+Entries
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com <http://www.iktek.com>
Re: Warning while loading ACI (Apache DS 1.5.7)
Posted by Stefano Gargiulo <ra...@gmail.com>.
I also have this warining in 1.5.7 but i'm using the demo ACI provided
in the getting started example:
cn="sevenSeasAuthorizationRequirementsACISubentry"
subtreeSpecification="{}"
prescriptiveACI="{
identificationTag "directoryManagerFullAccessACI",
precedence 11,
authenticationLevel simple,
itemOrUserFirst userFirst:
{
userClasses
{
name { "cn=Horatio Nelson,ou=people,o=sevenSeas" }
},
userPermissions
{
{
protectedItems
{
entry, allUserAttributeTypesAndValues
},
grantsAndDenials
{
grantAdd, grantDiscloseOnError, grantRead,
grantRemove, grantBrowse, grantExport, grantImport,
grantModify, grantRename, grantReturnDN,
grantCompare, grantFilterMatch, grantInvoke
}
}
}
}
}"
in my case the aci doesn't loads.. so i'm unable to use ACI in ApacheDS.
So i'm now using OpenDS in production, but i'm really waiting for a fix
or a solution (i prefer ApacheDS but i need strong Access control)
> The second prescriptiveACI seems to be ok, except that the
> 'grantDiscloseOnError' element starts on a new line without a space at
> first position.
PS. what do you think about JSON for ACI syntax in a next version of
ApacheDS?
Stefano.
Il 25/06/2010 22:03, Emmanuel Lecharny ha scritto:
> On 6/17/10 10:57 AM, Sudheer Kumar wrote:
>> dn: cn=RDSAuthorizationACISubentry,dc=xxx,dc=xx
>> changetype: add
>> objectclass: top
>> objectclass: subentry
>> objectclass: accessControlSubentry
>> cn: RDSAuthorizationACISubentry
>> subtreeSpecification: {}
>> prescriptiveACI: {
>> identificationTag "directoryManagerFullAccessACI",
>> precedence 11,
>> authenticationLevel simple,
>> itemOrUserFirst userFirst:
>> {
>> userClasses
>> {
>> name { "uid=adminuser,ou=people,dc=xxx,dc=com" }
>> },
>> userPermissions
>> {
>> {
>> protectedItems
>> {
>> entry, allUserAttributeTypesAndValues
>> },
>> grantsAndDenials
>> {
>> grantAdd, grantDiscloseOnError, grantRead,
>> grantRemove, grantBrowse, grantExport, grantImport,
>> grantModify, grantRename, grantReturnDN,
>> grantCompare, grantFilterMatch, grantInvoke
>> }
>> }
>> }
>> }
>> }
>> prescriptiveACI: {
>> identificationTag "allUsersACI",
>> precedence 10,
>> authenticationLevel none,
>> itemOrUserFirst userFirst:
>> {
>> userClasses
>> {
>> allUsers
>> },
>> userPermissions
>> {
>> {
>> protectedItems { entry, allUserAttributeTypesAndValues },
>> grantsAndDenials { grantRead, grantBrowse, grantReturnDN,
>> grantCompare, grantFilterMatch,
>> grantDiscloseOnError }
>> },
>> {
>> protectedItems { attributeType { userPassword } },
>> grantsAndDenials { denyRead, denyCompare, denyFilterMatch }
>> }
>> }
>> }
>> }
> The second prescriptiveACI seems to be ok, except that the
> 'grantDiscloseOnError' element starts on a new line without a space at
> first position.
>
> I don't know if it's a mail artifact or not, can you check that ?
>
Re: Warning while loading ACI (Apache DS 1.5.7)
Posted by Emmanuel Lecharny <el...@gmail.com>.
On 6/17/10 10:57 AM, Sudheer Kumar wrote:
> dn: cn=RDSAuthorizationACISubentry,dc=xxx,dc=xx
> changetype: add
> objectclass: top
> objectclass: subentry
> objectclass: accessControlSubentry
> cn: RDSAuthorizationACISubentry
> subtreeSpecification: {}
> prescriptiveACI: {
> identificationTag "directoryManagerFullAccessACI",
> precedence 11,
> authenticationLevel simple,
> itemOrUserFirst userFirst:
> {
> userClasses
> {
> name { "uid=adminuser,ou=people,dc=xxx,dc=com" }
> },
> userPermissions
> {
> {
> protectedItems
> {
> entry, allUserAttributeTypesAndValues
> },
> grantsAndDenials
> {
> grantAdd, grantDiscloseOnError, grantRead,
> grantRemove, grantBrowse, grantExport, grantImport,
> grantModify, grantRename, grantReturnDN,
> grantCompare, grantFilterMatch, grantInvoke
> }
> }
> }
> }
> }
> prescriptiveACI: {
> identificationTag "allUsersACI",
> precedence 10,
> authenticationLevel none,
> itemOrUserFirst userFirst:
> {
> userClasses
> {
> allUsers
> },
> userPermissions
> {
> {
> protectedItems { entry, allUserAttributeTypesAndValues },
> grantsAndDenials { grantRead, grantBrowse, grantReturnDN,
> grantCompare, grantFilterMatch,
> grantDiscloseOnError }
> },
> {
> protectedItems { attributeType { userPassword } },
> grantsAndDenials { denyRead, denyCompare, denyFilterMatch }
> }
> }
> }
> }
The second prescriptiveACI seems to be ok, except that the
'grantDiscloseOnError' element starts on a new line without a space at
first position.
I don't know if it's a mail artifact or not, can you check that ?
--
Regards,
Cordialement,
Emmanuel Lécharny
www.nextury.com