On Thu, Mar 7, 2013 at 11:53 PM, Michael Ströder <span dir="ltr">&lt;<a href="mailto:michael@stroeder.com" target="_blank">michael@stroeder.com</a>&gt;</span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">devzero2000 wrote:<br>
&gt; iirc, in ldapv3 the right thing to search is the subschemaSubentry<br>
&gt; attribute, as a base, of the rootDSE object.<br>
<br>
</div>In general each part of the DIT could have its own subschema subentry! So you<br>
have to read attribute subschemaSubentry in the entry for which you want to<br>
determine the schema.<br>
Not many schema-aware clients are doing this though.<br>
<br>
Ciao, Michael.<br></blockquote><div><br></div><div>Thanks, but I don&#39;t think this is my problem. I think it is a permission problem. It use to be that if I used </div><div><br></div><div>ldapsearch -x &quot;uid=jd&quot;</div>
<div><br></div><div>I would get all entries except the userPassword and shadowLastChange, but if I used: </div><div><br></div><div>ldapsearch -x -W -D &quot;cn=admin,ou=roles,dc=example,dc=com&quot; &quot;uid=jd&quot; </div>
<div><br></div><div>I would get everything, including the userPassword and shadowLastChange. Neither one show up now. Here are my permissions for these two attributes:</div><div><br></div><div><div>olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou</div>
<div> s auth by dn=&quot;cn=admin,dc=shadlenlab,dc=columbia,dc=edu&quot; write by * none</div></div><div><br></div><div>So, it looks like no one has read permissions for either attribute, if I am reading this correctly. I don&#39;t need to read the userPassword, but I do need to be able to read shadowLastChange. Can someone help me understand how to change olcAccess so that admin can read shadowLastChange using ldapmodify? I am finding the documentation on this extremely opaque.</div>
<div><br></div><div>thanks,</div><div>maria</div></div>