That is a usefull link. Thank you!
I finally manage this way:


access to dn.Subtree="ou=contacts,ou=people,dc=mcm,dc=com"
by dn.Subtree="ou=administradores,ou=people,dc=mcm,dc=com" write
by * read

What I wanted is to create a group of administrator to control everything and a group of normal users with only access control in their groups contacts.

I will also apply the group configuration you send me, thanks!

On Thu, 2009-01-29 at 17:25 +0100, Michael Ströder wrote: 
Miguel wrote:
> 
> I m trying to configure the ldap . I have created two groups (contact
> and administradores) within another one (people).
> 
> I would like administradores group to have all the permissions over
> contacts group. I have modified the slapd.conf in this way, but it
> doesn't work:
> 
> access to dn=".*,ou=contacts,ou=people,dc=mcm,dc=com"
>        by dn=".*,ou=administradores,ou=people,dc=mcm,dc=com" write
>        by * read

You should consult the fine FAQ - in particular:

"How do I use groups to manage access control?"

http://www.openldap.org/faq/data/cache/52.html

Ciao, Michael.