hallo there<div>and thank you for your quick reply...</div><div><br></div><div>1)is this the only access list you have used and works fine?</div><div>cause as i told you i want to  add the attributes below,you think they&#39;ll work?</div>
<div><br></div><div><div># Remember that rootdn has always write access</div><div># posixAccount/posixGroup attributes may only be accessible to root/ldapmaster (write) and pamproxy (read)</div><div>access to attrs=uid,uidNumber,gidNumber,gecos,homeDirectory,loginShell,memberUid</div>
<div>    by dn=&quot;cn=<a href="mailto:pamproxy@circuitcat.com">pamproxy@circuitcat.com</a>,ou=kerberos,dc=circuitcat,dc=com&quot; read</div><div><br></div><div># This is needed so sasl-regexp/GSSAPI works correctly</div>
<div>access to attrs=krb5PrincipalName</div><div>    by anonymous auth</div><div><br></div><div># Kerberos attributes may only be accessible to root/ldapmaster</div><div>access to attrs=krb5KeyVersionNumber,krb5PrincipalRealm,krb5EncryptionType,krb5KDCFlags,krb5Key,krb5MaxLife,krb5MaxRenew,krb5PasswordEnd,krb5ValidEnd,krb5ValidStart,krb5RealmNam</div>
<div>    by * none</div><div><br></div><div># We will be using userPassword to provide simple BIND access, so we don&#39;t want this to be user editable</div><div>access to attrs=userPassword</div><div>    by anonymous auth</div>
<div><br></div><div># Write access to common attributes for users</div><div>access to dn.subtree=&quot;ou=people,dc=circuitcat,dc=com&quot; attrs=telephoneNumber,facsimileTelephoneNumber,jpegPhoto,homePhone,homePostalAddress</div>
<div>    by self write</div><div>    by users read</div><div><br></div><div># Anything else we may have forgotten is writable by admin, and viewable by authenticated users</div><div>access to dn.subtree=&quot;dc=circuitcat,dc=com&quot;</div>
<div>    by users read</div><div><br></div><div><br></div><div>2)i have already <span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; border-collapse: collapse; color: rgb(51, 51, 51); ">re-init heimdal so i think  is not the problem...+i had some issues before that got solved by doing the heimdal re-init </span></div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; border-collapse: collapse; color: rgb(51, 51, 51); "><br></span></div><div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; border-collapse: collapse; color: rgb(51, 51, 51); "><br>
</span></div></div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><font color="#888888"><font class="Apple-style-span" color="#000000"><br>
</font>
</font></blockquote></div><br><br clear="all"><br><br>
</div>