Have a nice day !!
On Thu, Oct 25, 2018 at 5:02 PM Quanah Gibson-Mount <quanah(a)symas.com>
--On Thursday, October 25, 2018 10:25 AM +0200 Lirien Maxime
> OK thanks Quanah !
> I removed the "*" on ACL except for the last rule.
> I don't understand : it is rejected by the last rule. Why does it not
> match rule #3 ? Normally it may stop at the first match ?
> Oct 25 08:31:08 apsim-qualif slapd: => acl_mask: access to entry
> "dc=fr", attr "objectClass" requested
It's clearly asking for access to the objectClass attribute in "dc=fr",
which is not a part of your ACL#3, so it's correctly denied:
# 3) ********* CONTEXTCSN *********
access to dn.base="dc=fr" attrs=entry,children,contextcsn
by dn.exact="cn=Synchro,ou=Comptes Admin,dc=fr" read
by dn.exact="cn=supervision,ou=Comptes Clients,dc=fr" read
by * none
You need to modify the access to line to include objectClass.
Packaged, certified, and supported LDAP solutions powered by OpenLDAP: