openldap ACLs

[Martin Haase]

Hi Roger,
Am 10.03.2014 23:12, schrieb Holtom, Roger:
> I’m trying to get a version 2.4.0 of IdP running.  I was having some issues when using sp.testship.org.  My directory is openldap 2.4.31 (I also have 2.4.36 running if that becomes a factor in my issue).  We have a number of ACLs in the openldap config, and the ldap error log indicated that these were the issue.  So on a test ldap I made all attributes readable by anonymous.  That allowed a successful test against testshib.org’s SP.  I’m sure I’m overlooking something (probably simple!),
We usually use a service account specifically for the IdP in our
OpenLDAP servers, plus pertaining ACLs for that account. For
authentication (login.config) this is not necessarily needed (if you
know and can construct the users' DNs beforehand, i.e. without a
search), but for the attribute authority (attribute-resolver.xml), you
do need such an account.
Regards,
Martin
>  and we do need to keep some of our attributes controlled as to who has access.  Any ideas on what I should be doing?
>
> Roger Holtom
> Systems Engineer, Directory Services
> The University of Montana
> roger.holtom at umontana.edu
>
>
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-6
fax:   +49 7071 407109-9  
email: martin.haase at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2345 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20140311/ae35632c/attachment.bin