ghenry@suretecsystems.com wrote:

Ok. What can the rootdn do on the monitor database then? Write to anything? I can update the "Monitoring" section with this info then ;-)

As usual, the privilege of the rootdn consists in bypassing ACLs. In this case, you just need the rootdn, it doesn't need to be able to bind (i.e. no rootpw and no fancy SASL rules to map someone with that identity), since it will only be used for internal purposes, namely to look up where bdb custom monitoring will be placed.

p.

Ing. Pierangelo Masarati OpenLDAP Core Team

SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it --------------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Email: pierangelo.masarati@sys-net.it ---------------------------------------