Hi,<div><div>my DIT is some like this:</div><div><br></div><div><b>dc=&lt;base&gt;</b></div><div><b>|__ dc=&lt;domain_1&gt;</b></div><div><b>|     |__ o=&lt;org_1&gt;</b></div><div><b>|     |     |__cn=user_domain1_1</b></div>

<div><b>|     |     |__cn=user_domain1_2</b></div><div><b>|     |     |__cn=user_domain1_3</b></div><div><b>|     |__ o=&lt;org_2&gt;</b></div><div><b>|           |__cn=user_domain1_3</b></div><div><b>|           |__cn=user_domain1_4</b></div>

<div><b>|           |__cn=user_domain1_5</b></div><div><b>|__ dc=&lt;domain_2&gt;</b></div><div><b>     |__ o=&lt;org_3&gt;</b></div><div><b>     |     |__cn=user_domain2_1</b></div><div><b>     |     |__cn=user_domain2_2</b></div>

<div><b>     |     |__cn=user_domain2_3</b></div><div><b>     |__ o=&lt;org_4&gt;</b></div><div><b>           |__cn=user_domain2_3</b></div><div><b>           |__cn=user_domain2_4</b></div><div><b>           |__cn=</b><b>user_domain2_5</b></div>

<div><br></div><div>I would like to create one administrative account for each domain (&lt;domain_1&gt; and &lt;domain_2&gt;)</div><div><br></div><div>Here is my way:</div><div><br></div><div>I create a new branch:</div>
<div>
<br></div><div><b>dc=&lt;base&gt;</b></div><div><b>|__ o=Administrators</b></div><div><b>      |__ou=&lt;domain_1&gt;_Administrators</b></div><div><b>           |__ cn=Administrator1</b></div><div><br></div><div>then I insert a new directive in slapd.conf</div>

<div><br></div><div><b>access to dn.subtree=&quot;dc=&lt;domain_1&gt;,dc=&lt;base&gt;&quot; by dn=&quot;cn=Administrator1,ou=&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;&quot; write</b></div><div><br></div>

<div>Here the response when I try to connect with &lt;domain_1&gt;Administrators credentials:</div><div><br></div><div><b>Error opening connection:</b></div><div><b>[LDAP: error code 49 - Invalid Credentials]</b></div><div>

<br></div><div>Here the OpenLDAP&#39;s output in debug mode</div><div><br></div><div><b>daemon: activity on 1 descriptor</b></div><div><b>daemon: activity on:            </b></div><div><b>slap_listener_activate(7):      </b></div>

<div><b>daemon: epoll: listen=7 busy    </b></div><div><b>&gt;&gt;&gt; slap_listener(ldap://&lt;my_host&gt;:1389)</b></div><div><b>daemon: activity on 1 descriptor             </b></div><div><b>daemon: activity on:                         </b></div>

<div><b>daemon: epoll: listen=7 active_threads=0 tvp=NULL</b></div><div><b>daemon: listen=7, new connection on 11           </b></div><div><b>daemon: added 11r (active) listener=(nil)        </b></div><div><b>daemon: activity on 1 descriptor                 </b></div>

<div><b>daemon: activity on:                             </b></div><div><b>daemon: epoll: listen=7 active_threads=0 tvp=NULL</b></div><div><b>daemon: activity on 1 descriptor                 </b></div><div><b>daemon: activity on: 11r                         </b></div>

<div><b>daemon: read active on 11                        </b></div><div><b>daemon: epoll: listen=7 active_threads=0 tvp=NULL</b></div><div><b>connection_get(11): got connid=1000              </b></div><div><b>connection_read(11): checking for input on id=1000</b></div>

<div><b>ber_get_next                                      </b></div><div><b>ber_get_next: tag 0x30 len 83 contents:           </b></div><div><b>op tag 0x60, time 1268990296                      </b></div><div><b>ber_get_next</b></div>

<div><b>daemon: activity on 1 descriptor</b></div><div><b>daemon: activity on:</b></div><div><b>daemon: epoll: listen=7 active_threads=0 tvp=NULL</b></div><div><b>conn=1000 op=0 do_bind</b></div><div><b>ber_scanf fmt ({imt) ber:</b></div>

<div><b>ber_scanf fmt (m}) ber:</b></div><div><b>&gt;&gt;&gt; dnPrettyNormal: &lt;cn=Administrator1,ou=&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;&gt;</b></div><div><b>&lt;&lt;&lt; dnPrettyNormal: &lt;cn=Administrator1,ou=</b><b>&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;&gt;, &lt;cn=administrator1,ou=</b><b>&lt;domain_1&gt;dministrators,o=administrators,dc=&lt;base&gt;&gt;</b></div>

<div><b>do_bind: version=3 dn=&quot;cn=Administrator1,ou=</b><b>&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;&quot; method=128</b></div><div><b>bdb_dn2entry(&quot;cn=administrator1,ou=</b><b>&lt;domain_1&gt;administrators,o=administrators,dc=&lt;base&gt;&quot;)</b></div>

<div><b>=&gt; bdb_dn2id(&quot;dc=&lt;base&gt;&quot;)</b></div><div><b>&lt;= bdb_dn2id: got id=0x1</b></div><div><b>=&gt; bdb_dn2id(&quot;o=administrators,dc=&lt;base&gt;&quot;)</b></div><div><b>&lt;= bdb_dn2id: got id=0x12</b></div>

<div><b>=&gt; bdb_dn2id(&quot;ou=</b><b>&lt;domain_1&gt;administrators,o=administrators,dc=&lt;base&gt;&quot;)</b></div><div><b>&lt;= bdb_dn2id: got id=0x13</b></div><div><b>=&gt; bdb_dn2id(&quot;cn=administrator1,ou=</b><b>&lt;domain_1&gt;administrators,o=administrators,dc=&lt;base&gt;&quot;)</b></div>

<div><b>&lt;= bdb_dn2id: got id=0x14</b></div><div><b>entry_decode: &quot;cn=Administrator1,ou=</b><b>&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;&quot;</b></div><div><b>&lt;= entry_decode(cn=Administrator1,ou=</b><b>&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;)</b></div>

<div><b>send_ldap_result: conn=1000 op=0 p=3</b></div><div><b>send_ldap_response: msgid=1 tag=97 err=49</b></div><div><b>ber_flush2: 14 bytes to sd 11</b></div><div><b>daemon: activity on 1 descriptor</b></div><div><b>daemon: activity on: 11r</b></div>

<div><b>daemon: read active on 11</b></div><div><b>daemon: epoll: listen=7 active_threads=0 tvp=NULL</b></div><div><b>connection_get(11): got connid=1000</b></div><div><b>connection_read(11): checking for input on id=1000</b></div>

<div><b>ber_get_next</b></div><div><b>ber_get_next on fd 11 failed errno=0 (Success)</b></div><div><b>connection_read(11): input error=-2 id=1000, closing.</b></div><div><b>connection_closing: readying conn=1000 sd=11 for close</b></div>

<div><b>daemon: activity on 1 descriptor</b></div><div><b>daemon: activity on:</b></div><div><b>daemon: epoll: listen=7 active_threads=0 tvp=NULL</b></div><div><b>connection_close: conn=1000 sd=11</b></div><div><b>daemon: removing 11</b></div>

<div><br></div><div>Same result with this policy:</div><div><b>access to dn.subtree=&quot;dc=</b><b>&lt;domain_1&gt;,dc=&lt;base&gt;&quot; by * write</b></div><div><br></div><div>I can access only with this policy:</div>
<div>
<b>access to * by * write</b></div><div><br></div><div>I compiled opneldap 2.4.21 with default settings</div><div><br></div><div>Here my slapd.conf:</div><div><br></div><div><div><b>include         /sw/test_domain_openldap-2.4.21/etc/openldap/schema/core.schema</b></div>

<div><b>include         /sw/test_domain_openldap-2.4.21/etc/openldap/schema/cosine.schema</b></div><div><b><br></b></div><div><b>pidfile         /sw/test_domain_openldap-2.4.21/var/run/slapd.pid</b></div><div><b>argsfile        /sw/test_domain_openldap-2.4.21/var/run/slapd.args</b></div>

<div><b><br></b></div><div><b>#######################################################################</b></div><div><b># BDB database definitions</b></div><div><b>#######################################################################</b></div>

<div><b><br></b></div><div><b>database        bdb</b></div><div><b>suffix          &quot;dc=&lt;base&gt;&quot;</b></div><div><b>rootdn          &quot;cn=Manager,dc=&lt;base&gt;&quot;</b></div><div><b>rootpw          testdomain</b></div>

<div><b>directory       /sw/test_domain_openldap-2.4.21/var/openldap-data</b></div><div><b>index   objectClass     eq</b></div><div><b><br></b></div><div><b>access to * by * write</b></div><div><b>#access to dn.subtree=&quot;dc=&lt;domain_1&gt;,dc=&lt;base&gt;&quot; by * write</b></div>

<div><b>#access to dn.subtree=&quot;</b><b>dc=&lt;domain_1&gt;,dc=&lt;base&gt;&quot; by dn=&quot;cn=Administrator1,ou=&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;&quot; write</b></div><div><br></div><div>

thanks in advance!</div><div>Carlo</div></div></div>