Delegate administration rights to OU in OpenLDAP?
How would I allow a user to administer subordinates of only a single OU in an OpenLDAP directory? The goal here is I want the user to be able to create and update users under a specific OU only.
I sure miss Active Directory... :)
Solution 1:
By using OpenLDAP Access Control Lists. You need to put to your slapd.conf a new line similar to this under to that specific OU's slapd.conf entry:
access to dn.subtree="ou=yourou,dc=yourdomain,dc=com"
by dn.exact="cn=youradministratoruser,ou=yourou,dc=yourdomain,dc=com"
(other ACL rules go here)