1) If this ACL is in the global context, per-database ACLs
will precede it. They may be giving read access.
This gave me the hint I needed. Moving the ACL below "bdb cn=log" but above
"bdb dc=soe,dc=ucsc,dc=edu" worked. Previously I had all my ACLs at the bottom
of slapd.conf together, rather than divided out on a per-DB basis.
UC Santa Cruz