ACL permissions control is used in LDAP.
In the/etc/openldap/slapd.conf file:
## see slapd.conf (5) for details on configuration options.# This File should not be world readable. #include/etc/openldap/schema/corba.schemainclude/ etc/openldap/schema/core.schemainclude/etc/openldap/schema/cosine.schemainclude/etc/openldap/schema/ duaconf.schemainclude/etc/openldap/schema/dyngroup.schemainclude/etc/openldap/schema/ inetorgperson.schemainclude/etc/openldap/schema/java.schemainclude/etc/openldap/schema/misc.schemainclude/etc/ openldap/schema/nis.schemainclude/etc/openldap/schema/openldap.schemainclude/etc/openldap/schema/ ppolicy.schemainclude/etc/openldap/schema/collective.schema# allow ldapv2 client connections. this is not the default.allow bind_v2# do not enable referrals until after you have a working directory# Service and an understanding of referrals. #referraLldap://root.openldap.orgpidfile/var/run/openldap/slapd.pidargsfile/var/run/openldap/slapd.args# load dynamic backend modules# - modulepath is architecture dependent value (32/64-bit system) # - back_sql.la overlay requires openldap-server-sql package# - dyngroup.la and dynlist.la cannot be used at the same time#modulepath /usr/lib/openldap# modulepath /usr/lib64/ Openldap# moduleload accesslog.la# moduleload auditlog.la# moduleload back_ sql.la# moduleload chain.la# moduleload collect.la# moduleload constraint.la# moduleload dds.la# moduleload deref.la# moduleload dyngroup.la# moduleload dynlist.la# moduleload memberof.la# moduleload pbind.la# moduleload pcache.la# moduleload ppolicy.la# moduleload refint.la# moduleload retcode.la# moduleload rwm.la# moduleload seqmod.la# moduleload smbk5pwd.la# moduleload sssvlv.la# moduleload syncprov.la# moduleload translucent.la# moduleload unique.la# moduleload valsort.la# the next three lines allow use of tls for encrypting connections using a# dummy test certificate which you can generate by running# /usr/libexec/openldap/generate-server-cert.sh. your client Software may balk# at self-signed certificates, however. tlscacertificatepath /etc/openldap/certstlscertificatefile "\" Openldap server\ "" Tlscertificatekeyfile /etc/openldap/certs/password# sample security restrictions#require integrity protection (prevent hijacking) #Require 112-bit (3des or better) encryption for updates#require 63-bit encryption for simple bind# security ssf=1 update_ssf=112 simple_bind =64# sample access control policy: #Root dse: allow anyone to read it#Subschema (sub) entry dse: allow anyone to read it#other dses: #Allow self write access#Allow authenticated users read access#Allow anonymous users to authenticate#directives needed to implement policy:# access to dn.base= "" by * read# access to dn.base= "Cn=Subschema" by * read# the following statements that control permissions. Access to dn.subtree= "OU=PEOPLE,DC=BAWO,DC=CN" attrs=userpassword,shadowlastchangeby dn= " CN=ADMIN,DC=BAWO,DC=CN " writeby self writeby anonymous authby *&Nbsp;read#access to attrs=uid,uidnumber,gidnumber,memberuid#by * read# if no access controls are present, the default policy## allows anyone and everyone to read anything but restricts# updates to rootdn. (e.g., "Access to * by * read") ## rootdn can always read and write everything!# enable on-the-fly configuration (CN =config) database configaccess to *by dn.exact= "gidnumber=0+uidnumber=0,cn=peercred,cn= External,cn=auth " manageby * none# enable server status monitoring (CN =monitor) database monitoraccess to *by dn.exact= "gidnumber=0+uidnumber=0,cn=peercred,cn= External,cn=auth " read by dn.exact=" Cn=admin,dc=bawo, DC=CN " readby * none######################################################################## database definitions###################################################################### #databasebdbsuffix "dc=XX,dc= CN "Checkpoint1024 15rootdn" CN=ADMIN,DC=XX,DC=CN "# cleartext passwords, especially for  THE ROOTDN, SHOULD# BE AVOIDED.  SEE SLAPPASSWD (8) and Slapd.conf (5) for details.# Use of strong authentication Encouraged.rootpw123456# rootpw{crypt}ijfyncsnctbyg# the database directory must exist prior to running slapd AND # should only be accessible by the slapd and slap tools.# mode 700 Recommended.directory/var/lib/ldap# indices to maintain for this databaseindex objectclass &nBsp; eq,presindex ou, Cn,mail,surname,givenname eq,pres,subindex uidnumber,gidnumber, loginshell eq,presindex uid,memberuid eq,pres,subindex Nismapname,nismapentry eq,pres,sub
After adding the above statement, you need to update the configuration file to the LDAP service.
Service SLAPD stoprm-rf/etc/openldap/slapd.d/chown-r ldap:ldap/var/lib/ldapchown-r ldap:ldap/etc/openldap/# To test and generate the configuration file: slaptest-f/etc/openldap/slapd.conf-f/etc/openldap/slapd.d# returns config for file testing succeeded, the configuration is successful. Chown-r Ldap:ldap/etc/openldap/slapd.dservice SLAPD Restart
Once completed, the LDAP permissions are set successfully. Users can modify their own password in the phpldapadmin.
Other setup items can be explored on their own.
Additional Permission Settings Reference
Http://www.openldap.org/doc/admin24/access-control.html
slapd.conf file Configuration
LDAP Configuration detailed explanation
This article is from the "Network Computer" blog, please make sure to keep this source http://lovelinuxops.blog.51cto.com/10426562/1707732
LDAP user changes their own password