My installation and setup of slapd 2.4.21 is done on Ubuntu 10.04 according to the official doc. Now ldapsearch -x will give me nothing, but ldapsearch -x -Drootdn -w rootpw will output everything. I do have
olcAccess: to * by dn="cn=Manager,dc=a,dc=b" write by * read
in the backend configuration. What's wrong? "getent passwd testuser" output nothing, must be due to it. Thank you in advance.
You have to perform authentication, and olcAccess is for configuring authorization. In simple words, slapd still requires you to prove who you are (authenticate, which in LDAP slang is called "bind" for some strange reason) before allowing you to read data.
This is normal. If you don't want to provide -D and -w each time, use corresponding bind* options in ldap.conf, which is located in various places in various unices. Google says on Ubuntu 10.04 it's
/etc/ldap/ldap.conf
Try to look in slapd's log file, in most case answer to "wtf is going on?" is there. To read data anonymous user also should be able to read root DSE and "cn=Subschema". Corresponding entries looks like this:
access to dn.base="" by * read
access to dn.base="cn=Subschema" by * read
These entries should be placed in global configuration, not in backend.
P.S.: rootdn always have write access to backend, so you don't need to specify it in ACLs
-Drootdn -w rootpw
-D/-w is used to bind a dn, then searching LDAP tree as authenticated user. Please make sure your OpenLDAP is allowed anonymous binding.
If you're using slapd.conf for server configuration, you can use this setting in slapd.conf:
allow bind_anon_cred
And below setting is used to disable anonymous binding:
disallow bind_anon
Also, below setting won't work at all:
olcAccess: to * by dn="cn=Manager,dc=a,dc=b" write by * read
Because root dn always has ALL privileges, including read, write.
