Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create an ACL entry to allow users specified in the owner attribute of a group to manage the group, and also allow groups, including nested groups to be specified as owners.

I've got this rule, which allows admin access to nested members of a specific group:

{0}to * by ssf=128 set="user & [cn=Administrators,ou=LDAP,dc=Applications,dc=example,dc=com]/member*" manage by * break

And I've got this rule which works for granting management permissions to users that are directly specified as owners:

{2}to dn.children="dc=Groups,dc=example,dc=com" by ssf=128 set="user & this/owner" manage

but so far I haven't been able to figure out how to combine the two concepts to allow specifying groups as owners. Anyone gotten something like this working?

share|improve this question
Is this DBA related? – gbn Mar 8 '11 at 18:43
@gbn : do we really have to do this for every non-RDBMS question? See – Joe Mar 8 '11 at 18:56
@Joe: fair enough. It isn't an LDAP query though... – gbn Mar 8 '11 at 19:00
@gbn : yep, so it'd be something for the (ldap|database) administrator to do, not a programmer trying to query the LDAP server. – Joe Mar 8 '11 at 19:15
up vote 4 down vote accepted

Almost as soon as I posted the question, I saw the dumb mistake I made -- I forgot to include the permission to be granted in the acl entry. This entry is tested and works for users as owners, as well as groups and nested groups as owners (with a break-through so non-owners aren't rejected outright):

to dn.children="dc=Groups,dc=example,dc=com" by ssf=128 set="user & this/owner" manage by ssf=128 set="user & this/owner*/member*" manage by * break

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.