Hi Owen,<div>thanks for the explanation!</div><div>Now everything woks fine with these options:</div><div> access to dn.subtree=&quot;o=Administrators,dc=&lt;base&gt;&quot;<div>        by anonymous auth</div><div>access to dn.subtree=&quot;dc=&lt;domain_1&gt;,dc=&lt;base&gt;&quot;</div>

<div>        by dn=&quot;cn=Administrator1,ou=&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;&quot; write</div><div>access to dn.subtree=&quot;dc=&lt;domain_2&gt;,dc=&lt;base&gt;&quot;</div><div>        by dn=&quot;cn=Administrator1,ou=&lt;domain_2&gt;Administrators,o=Administrators,dc=&lt;base&gt;&quot; write</div>

<div><br></div><div>Thank you!</div><div>Carlo</div><div><br></div><br><div class="gmail_quote">2010/3/19 Owen Marshall <span dir="ltr">&lt;<a href="mailto:omarshall@facilityone.com">omarshall@facilityone.com</a>&gt;</span><br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">On Fri, 2010-03-19 at 12:54 +0100, Carlo Pradissitto wrote:<br>
&gt; access to * by * write<br>
&gt; #access to dn.subtree=&quot;dc=&lt;domain_1&gt;,dc=&lt;base&gt;&quot; by * write<br>
&gt; #access to dn.subtree=&quot;dc=&lt;domain_1&gt;,dc=&lt;base&gt;&quot; by dn=&quot;cn=Administrator1,ou=&lt;domain_1&gt;Administrators,o=Administrators,dc=&lt;base&gt;&quot; write<br>
<br>
</div>With no access stanza, OpenLDAP defaults to:<br>
<br>
access to *<br>
       by anonymous  read<br>
       by *          none<br>
<br>
As soon as you assign an access stanza, this default goes away.<br>
<br>
As it stands, you are not giving Administrator1 any permission to bind.<br>
Your access stanza doesn&#39;t mention anything under the administrative<br>
section.<br>
<br>
At the very least, you will need something like:<br>
access to dn.subtree=&quot;o=Administrators,dc=&lt;base&gt;&quot; by anonymous bind<br>
<br>
You *will* need to fine-tune this. ;-)<br>
<br>
Some decent information on ACLs can be found at<br>
<a href="http://www.zytrax.com/books/ldap/ch6/" target="_blank">http://www.zytrax.com/books/ldap/ch6/</a><br>
<br>
Also, set debug level 128 to view ACL processing -- this will be<br>
invaluable to you.<br>
<font color="#888888"><br>
--<br>
Owen Marshall<br>
FacilityONE<br>
<a href="mailto:omarshall@facilityone.com">omarshall@facilityone.com</a> | (502) 805-2126<br>
<br>
</font></blockquote></div><br></div>