--On Tuesday, November 14, 2017 8:56 PM +0000 Kaya Saman kayasaman@gmail.com wrote:

access to *         by ssf=128 self write     by ssf=128 anonymous auth     by ssf=128 users read

# Added ACL for open access to AddressBook in Read and Search only mode

access to dn.children="ou=AddressBook,dc=domain,dc=com"     by * search     by * read

Your second ACL will never be evaluated, since the first ACL matches everything. As noted in the slapd.access(5) man page, ACL processing stops on the first matching ACL.

In addition, in your second ACL, the "by * read" will never be processed, because of the match to "by * search". If you're already planning on granting read, there is no point to having by * search there at all.

I.e., your ACLs should be:

access to dn.children="ou=AddressBook,dc=domain,dc=com"     by * read

access to *     by ssf=128 self write     by ssf=128 anonymous auth     by ssf=128 users read

And I generally doubt you want to give users read to "*", as this means they can read the userPassword values of other users, etc.

You might want something more like:

access to dn.children="ou=AddressBook,dc=domain,dc=com"     by * read

access to attrs=userPassword by ssf=128 anonymous auth by ssf=128 self write

access to *     by ssf=128 self write     by ssf=128 users read

And yes, you have to remove the global SSF setting if the phone cannot support startTLS on port 389.

--Quanah

--

Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com