--On Thursday, October 25, 2018 10:25 AM +0200 Lirien Maxime
<maxime.lirien@gmail.com> wrote:

> OK thanks Quanah !
>  I removed the "*" on ACL except for the last rule.
> I don't understand : it is rejected by the last rule. Why does it not
> match rule #3 ? Normally it may stop at the first match ?

> Oct 25 08:31:08 apsim-qualif slapd[27308]: => acl_mask: access to entry
> "dc=fr", attr "objectClass" requested

Hi Lirien,

It's clearly asking for access to the objectClass attribute in "dc=fr",
which is not a part of your ACL#3, so it's correctly denied:

# 3) ********* CONTEXTCSN *********
access to dn.base="dc=fr" attrs=entry,children,contextcsn
   by dn.exact="cn=Synchro,ou=Comptes Admin,dc=fr" read
   by dn.exact="cn=supervision,ou=Comptes Clients,dc=fr" read
   by * none

You need to modify the access to line to include objectClass.

--Quanah

--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>