<div dir="ltr"><div>Hi, Jan</div><div>First of all, you should be sure that you don't use Unix password for authentication. Try to change user password by passwd command and check that this password did not sync to LDAP.</div><div>Also please pay attention that in my case break statement in ACL for unknown reason does not stop search through ACL rules.<span class="gmail-im"><span style="background-color:rgb(255,255,0)"><br></span></span></div><div><span class="gmail-im"><span style="background-color:rgb(255,255,0)"><br></span></span></div><div>Best regards, Oleksandr<span class="gmail-im"><span style="background-color:rgb(255,255,0)"><br></span></span></div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, 28 Nov 2018 at 09:26, Parttimaa Jan <<a href="mailto:jan.parttimaa@myy.haaga-helia.fi">jan.parttimaa@myy.haaga-helia.fi</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div id="m_4686735313850125263divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Hi,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Here is our complete ACI. We make our OpenLDAP installation and configuration following this
<a href="https://wiki.evolveum.com/display/midPoint/OpenLDAP+Installation+and+Configuration" class="m_4686735313850125263OWAAutoLink" id="m_4686735313850125263LPlnk807863" target="_blank">
wiki article</a>:</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"></p>
<div>dn: olcDatabase={1}mdb,cn=config</div>
<div>changetype: modify</div>
<div>replace: olcAccess</div>
<div><span style="background-color:rgb(255,255,0)">olcAccess: to attrs=userPassword dn.subtree="ou=people,dc=ldap,dc=pisnismiehet,dc=local" filter="(midPointAccountStatus=disabled)" by dn.subtree="ou=unixgroups,dc=ldap,dc=pisnismiehet,dc=local" none by
anonymous none by * break</span></div>
<div>olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" write by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth write by anonymous auth by self write by * none</div>
<div>olcAccess: to dn.base="" by * read</div>
<div>olcAccess: to dn.subtree="ou=people,dc=ldap,dc=pisnismiehet,dc=local" by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" write</div>
<div>olcAccess: to dn.subtree="ou=groups,dc=ldap,dc=pisnismiehet,dc=local" by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" write</div>
<div>olcAccess: to dn.subtree="ou=unixgroups,dc=ldap,dc=pisnismiehet,dc=local" by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" write</div>
<div>olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth write by dn="cn=idm,ou=Administrators,dc=ldap,dc=pisnismiehet,dc=local" read by self read by * none</div>
<div><br>
</div>
We add the yellow line above according to <a href="https://github.com/Evolveum/midpoint/blob/master/samples/resources/openldap/olcAccess.ldif" class="m_4686735313850125263OWAAutoLink" id="m_4686735313850125263LPlnk145890" target="_blank">
this</a> but no luck. Disabled users on MidPoint can still login to Linux Server and Desktop via OpenLDAP. We added midpoint.schema to our OpenLDAP successfully.
<p></p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Is that yellow line correct? Should I add or modify something else?</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Best Regards,</p>
<p style="margin-top:0;margin-bottom:0">Jan Parttimaa</p>
<p style="margin-top:0;margin-bottom:0"><br>
<br>
</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<div id="m_4686735313850125263Signature">
<div id="m_4686735313850125263divtagdefaultwrapper" dir="ltr" style="color:rgb(0,0,0);font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;font-size:12pt;background-color:rgb(255,255,255)">
<p><span style="color:rgb(0,0,0)"><i><span style="font-family:Calibri,Arial,Helvetica,sans-serif">Jan Parttimaa</span></i></span></p>
<span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span><span style="color:rgb(0,0,0)"><i></i></span><span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span>
<p><span style="color:rgb(0,0,0)"><i><span style="font-family:Calibri,Arial,Helvetica,sans-serif">1602738,</span></i></span></p>
<span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span><span style="color:rgb(0,0,0)"><i></i></span><span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span>
<p><span style="color:rgb(0,0,0)"><i><span style="font-family:Calibri,Arial,Helvetica,sans-serif">Tietojenkäsittelyn koulutusohjelma,</span></i></span></p>
<span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span><span style="color:rgb(0,0,0)"><i></i></span><span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span>
<p><span style="color:rgb(0,0,0)"><i><span style="font-family:Calibri,Arial,Helvetica,sans-serif">Haaga-Helia ammattikorkeakoulu</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif"></span><span style="font-family:Calibri,Arial,Helvetica,sans-serif">,
Pasilan kampus</span></i></span></p>
</div>
</div>
<br>
<br>
<div style="color:rgb(0,0,0)">
<hr style="display:inline-block;width:98%">
<div id="m_4686735313850125263divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Lähettäjä:</b> midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com" target="_blank">midpoint-bounces@lists.evolveum.com</a>> käyttäjän Parttimaa Jan <<a href="mailto:jan.parttimaa@myy.haaga-helia.fi" target="_blank">jan.parttimaa@myy.haaga-helia.fi</a>> puolesta<br>
<b>Lähetetty:</b> tiistai 27. marraskuuta 2018 8.45<br>
<b>Vastaanottaja:</b> <a href="mailto:gustav.palos@evolveum.com" target="_blank">gustav.palos@evolveum.com</a>; midPoint General Discussion<br>
<b>Aihe:</b> Re: [midPoint] Disable OpenLDAP Users on MidPoint</font>
<div> </div>
</div>
<div lang="FI" link="blue" vlink="purple">
<div class="m_4686735313850125263x_WordSection1">
<p class="m_4686735313850125263x_MsoNormal"><span>Hi,</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span> </span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">I checked that and I add this to aci.ldif but no luck:</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">olcAccess: to attrs=userPassword dn.subtree="ou=people,dc=ldap,dc=pisnismiehet,dc=local" filter="(midPointAccountStatus=disabled)" by dn.subtree="ou=unixgroups,dc=ldap,dc=pisnismiehet,dc=local" none by anonymous
none by * break</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">Disabled user can still login to Linux via OpenLDAP.</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">We did OpenLDAP installation and configuration following this
<a href="https://wiki.evolveum.com/display/midPoint/OpenLDAP+Installation+and+Configuration" id="m_4686735313850125263LPlnk232975" class="m_4686735313850125263OWAAutoLink" target="_blank">
wiki article</a>.</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">Not sure is that ACI row above correct or not.</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">Best Regards,</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">Jan Parttimaa</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="m_4686735313850125263x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt;color:black">Jan Parttimaa</span></i><span style="font-size:12.0pt;color:black"></span></p>
<p class="m_4686735313850125263x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt;color:black">1602738,</span></i><span style="font-size:12.0pt;color:black"></span></p>
<p class="m_4686735313850125263x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt;color:black">Tietojenkäsittelyn koulutusohjelma,</span></i><span style="font-size:12.0pt;color:black"></span></p>
<p class="m_4686735313850125263x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt;color:black">Haaga-Helia ammattikorkeakoulu, Pasilan kampus</span></i><span style="font-size:12.0pt;color:black"></span></p>
<p class="m_4686735313850125263x_MsoNormal"><span> </span></p>
<p class="m_4686735313850125263x_MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com" target="_blank">midpoint-bounces@lists.evolveum.com</a>>
<b>On Behalf Of </b>Pálos Gustáv<br>
<b>Sent:</b> maanantai 26. marraskuuta 2018 22.55<br>
<b>To:</b> midPoint General Discussion <<a href="mailto:midpoint@lists.evolveum.com" target="_blank">midpoint@lists.evolveum.com</a>><br>
<b>Subject:</b> Re: [midPoint] Disable OpenLDAP Users on MidPoint</span></p>
<p class="m_4686735313850125263x_MsoNormal"> </p>
<div>
<div>
<p class="m_4686735313850125263x_MsoNormal">Hi Jan,</p>
<div>
<p class="m_4686735313850125263x_MsoNormal"> </p>
</div>
<div>
<p class="m_4686735313850125263x_MsoNormal">please see:</p>
</div>
<div>
<p class="m_4686735313850125263x_MsoNormal"><a href="https://wiki.evolveum.com/display/midPoint/Recommended+OpenLDAP+Structure#RecommendedOpenLDAPStructure-AccountDisableMechanism" id="m_4686735313850125263LPlnk734185" class="m_4686735313850125263OWAAutoLink" target="_blank">https://wiki.evolveum.com/display/midPoint/Recommended+OpenLDAP+Structure#RecommendedOpenLDAPStructure-AccountDisableMechanism</a></p>
</div>
<div>
<p class="m_4686735313850125263x_MsoNormal"> </p>
</div>
<div>
<p class="m_4686735313850125263x_MsoNormal">Best regards,</p>
</div>
<div>
<p class="m_4686735313850125263x_MsoNormal"> </p>
</div>
<div>
<p class="m_4686735313850125263x_MsoNormal">Gustav</p>
</div>
</div>
</div>
<p class="m_4686735313850125263x_MsoNormal"> </p>
<div>
<div>
<p class="m_4686735313850125263x_MsoNormal">po 26. 11. 2018 o 19:57 Parttimaa Jan <<a href="mailto:jan.parttimaa@myy.haaga-helia.fi" id="m_4686735313850125263LPlnk98612" class="m_4686735313850125263OWAAutoLink" target="_blank">jan.parttimaa@myy.haaga-helia.fi</a>> napísal(a):</p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="m_4686735313850125263x_MsoNormal">Hi,</p>
<p class="m_4686735313850125263x_MsoNormal"> </p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">I read that disable OpenLDAP users in MidPoint can be pain in a ass. How do you disable OpenLDAP users in MidPoint? Any tips and tricks about this?</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">Best Regards,</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US">Jan Parttimaa</span></p>
<p class="m_4686735313850125263x_MsoNormal"><span lang="EN-US"> </span></p>
<p class="m_4686735313850125263x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt;color:black">Jan Parttimaa</span></i></p>
<p class="m_4686735313850125263x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt;color:black">1602738,</span></i></p>
<p class="m_4686735313850125263x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt;color:black">Tietojenkäsittelyn koulutusohjelma,</span></i></p>
<p class="m_4686735313850125263x_MsoNormal" style="background:white"><i><span style="font-size:12.0pt;color:black">Haaga-Helia ammattikorkeakoulu, Pasilan kampus</span></i></p>
<p class="m_4686735313850125263x_MsoNormal"> </p>
</div>
</div>
<p class="m_4686735313850125263x_MsoNormal">_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" id="m_4686735313850125263LPlnk493832" class="m_4686735313850125263OWAAutoLink" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" id="m_4686735313850125263LPlnk395671" class="m_4686735313850125263OWAAutoLink" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a></p>
</blockquote>
</div>
<p class="m_4686735313850125263x_MsoNormal"><br clear="all">
</p>
<div>
<p class="m_4686735313850125263x_MsoNormal"> </p>
</div>
<p class="m_4686735313850125263x_MsoNormal">-- </p>
<div>
<div>
<div>
<p class="m_4686735313850125263x_MsoNormal">Gustáv Pálos</p>
</div>
<div>
<p class="m_4686735313850125263x_MsoNormal">Identity Engineer</p>
</div>
<p class="m_4686735313850125263x_MsoNormal"><a href="http://evolveum.com/" id="m_4686735313850125263LPlnk455883" class="m_4686735313850125263OWAAutoLink" target="_blank"><span style="font-size:9.5pt;color:#1155cc">evolveum.com</span></a></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="color:rgb(76,76,76)">Best regards, <br><br><img src="cid:o.nekriach@dynatech.lv1520941785292-7770"> <br><br>Oleksandr Nekriach | Identity and access management engineer <br><br>Dynatech, <a href="https://www.google.com/maps/place/DYNATECH/@56.9575205,24.1107235,17z/data=!3m1!4b1!4m5!3m4!1s0x46eecf5753e42351:0x23b120b9745cae62!8m2!3d56.9575205!4d24.1129122" target="_blank">Jeruzalemes iela 1, Rīga, LV-1010, Latvia</a><br><br><div style="display:inline-block"><a href="tel:+371%2025%20314%20685" value="+37125314685" target="_blank">+37125314685</a></div>, <div style="display:inline-block"><a href="mailto:o.nekriach@dynatech.lv" target="_blank">o.nekriach@dynatech.lv</a></div> | <div style="display:inline-block"><a href="http://www.dynatech.lv" target="_blank">www.dynatech.lv</a></div> <br><br>Stay connected: <br><div style="display:inline-block;margin:5px 5px 0px 0px"><a href="https://www.facebook.com/DynatechLatvia/?ref=br_rs" target="_blank"><img src="cid:o.nekriach@dynatech.lv1520941785292-7771"></a></div><div style="display:inline-block;margin:5px 0px 0px"><a href="https://www.linkedin.com/company-beta/17893047/" target="_blank"><img src="cid:o.nekriach@dynatech.lv1520941785292-7772"></a></div><br><br><span style="font-size:11px;color:rgb(161,161,161)">Confidentiality
Notice: This message contains confidential information and is intended
only for the named recipient(s). If you are not the addressee you may
not copy, distribute or perform any other activities with this
information. If you have received this transmission in error, please
notify us by e-mail immediately. E-mail transmission cannot be
guaranteed to be secure or error-free as information could be
intercepted, corrupted, lost, destroyed, arrive late or incomplete, or
contain viruses.</span></span></div></div></div></div>