I'm trying to create an ACL entry to allow users specified in the owner attribute of a group to manage the group, and also allow groups, including nested groups to be specified as owners.

I've got this rule, which allows admin access to nested members of a specific group:

{0}to * by ssf=128 set="user & [cn=Administrators,ou=LDAP,dc=Applications,dc=example,dc=com]/member*" manage by * break

And I've got this rule which works for granting management permissions to users that are directly specified as owners:

{2}to dn.children="dc=Groups,dc=example,dc=com" by ssf=128 set="user & this/owner" manage

but so far I haven't been able to figure out how to combine the two concepts to allow specifying groups as owners. Anyone gotten something like this working?

  • Is this DBA related?
    – gbn
    Mar 8, 2011 at 18:43
  • @gbn : do we really have to do this for every non-RDBMS question? See meta.dba.stackexchange.com/questions/11
    – Joe
    Mar 8, 2011 at 18:56
  • @Joe: fair enough. It isn't an LDAP query though...
    – gbn
    Mar 8, 2011 at 19:00
  • 1
    @gbn : yep, so it'd be something for the (ldap|database) administrator to do, not a programmer trying to query the LDAP server.
    – Joe
    Mar 8, 2011 at 19:15

1 Answer 1


Almost as soon as I posted the question, I saw the dumb mistake I made -- I forgot to include the permission to be granted in the acl entry. This entry is tested and works for users as owners, as well as groups and nested groups as owners (with a break-through so non-owners aren't rejected outright):

to dn.children="dc=Groups,dc=example,dc=com" by ssf=128 set="user & this/owner" manage by ssf=128 set="user & this/owner*/member*" manage by * break

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.