May 06, 2004

Confidential flag for LDAP entries

Going about making LDAP FERPA-compliant by adding an ACI to confidential records.

The ACI is

  • (targetattr = “*”) (version 3.0;acl “Confidential”;deny(all)(userdn != “ldap:///self” and userdn != “ldap:///uid=*,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot”);)

And then we have to change all the authentication points to do DN searching by binding as an object in the “ou=Administrators,ou=TopologyManagement,o=NetscapeRoot” tree. Authentication points currently include PAM-LDAP (/usr/local/etc/ldap.conf), MovableType, Self Service Quotas, RADIUS, and Moodle. All seem to work fine at present. In the future, WebDB will be added to this.

Posted by Rowan Littell at May 6, 2004 02:45 PM