Hi folks,

i have just installed openldap and i am having trouble to understand access directive:

I have 6 access rules :

################################################################################
# access definition on ou=people,dc=ufv,dc=br
################################################################################

access to dn.one="ou=people,dc=ufv,dc=br" attrs=userPassword
        by self read
        by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read
        by anonymous auth
        by * none

access to dn.one="ou=people,dc=ufv,dc=br" attrs=uid,homeDirectory
        by self read
        by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read
        by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read

access to dn.one="ou=people,dc=ufv,dc=br" attrs=cn,uidNumber,gidNumber,loginShell,gecos,description
        by self read
        by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read

access to dn.one="ou=people,dc=ufv,dc=br" attrs=mail,mailMessageStore,mailAlternateAddress,qmailUID,qmailGID,mailHost,mailForwardingAddress,deliveryProgramPath,qmailDotMode,deliveryMode,mailReplyText,accountStatus,qmailAccountPurge,mailQuotaSize,mailQuotaCount,mailSizeMax
        by self read
        by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read

access to dn.one="ou=people,dc=ufv,dc=br"
        by self read
        by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
        by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read

access to dn.base="ou=people,dc=ufv,dc=br"
        by dn.base="cn=ypldap,ou=appsrv,dc=ufv,dc=br" read
        by dn.base="cn=mail,ou=appsrv,dc=ufv,dc=br" read

I have some rules, as you can see, giving acess to certain attributes of anything below (one level) ou=people,dc=ufv,dc=br. I have another rule given access to everything on the same level, this is the rule 5th.

Everything works ok, for instance:

sioux@gustav$ ldapsearch -b uid=sioux,ou=people,dc=ufv,dc=br homedirectory
SASL/GSSAPI authentication started
SASL username: sioux@UFV.BR
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <uid=sioux,ou=people,dc=ufv,dc=br> with scope subtree
# filter: (objectclass=*)
# requesting: homedirectory
#

# sioux, people, ufv.br
dn: uid=sioux,ou=people,dc=ufv,dc=br
homeDirectory: /home/sioux

# search result
search: 5
result: 0 Success

# numResponses: 2
# numEntries: 1
sioux@gustav$

But if i comment the 5th rule (I keep the others, giving access to the homedirectory attribute), it does not work:

sioux@gustav$ ldapsearch -b uid=sioux,ou=people,dc=ufv,dc=br homedirectory
SASL/GSSAPI authentication started
SASL username: sioux@UFV.BR
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <uid=sioux,ou=people,dc=ufv,dc=br> with scope subtree
# filter: (objectclass=*)
# requesting: homedirectory
#

# search result
search: 5
result: 32 No such object

# numResponses: 1
sioux@gustav$

Does anybody here know why ?

Thanks in advance.