I want to change the settings my new LDAP server let only users of the server read entries and not anonymous. Currently my olcAccess looks like this:
olcAccess: {0} to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1} to * by self write by dn="cn=admin,dc=example,dc=com" write by * read
I tried to change it like so:
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1} to * by self write by dn="cn=admin,dc=exampme,dc=com" write by users read
But that gives me no access at all. Can someone help me on this?
thanks
UPDATE: This is the log read after the changes mentioned by userxxx
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 fd=28 ACCEPT from IP=87.149.169.6:64121 (IP=0.0.0.0:389)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=0 do_bind: invalid dn (pbrechler)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=0 RESULT tag=97 err=34 text=invalid DN
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 op=1 UNBIND
Sep 30 10:47:21 j16354 slapd[11805]: conn=1437 fd=28 closed
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 fd=28 ACCEPT from IP=87.149.169.6:64122 (IP=0.0.0.0:389)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=0 do_bind: invalid dn (pbrechler)
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=0 RESULT tag=97 err=34 text=invalid DN
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 op=1 UNBIND
Sep 30 10:47:21 j16354 slapd[11805]: conn=1438 fd=28 closed
pbrechler should be a valid user but has no system user (we don't need it) admin does't work also
- List item
olcRootDN
which I assume iscn=admin,dc=exampme,dc=com
in your examples). The admin user always has write access to everything.by users read
should be all you need, so if this is really your complete ACL it should work as you posted. For good measure make sure access toattrs=userPassword,shadowLastChange
includesby users auth
as well.