I'm trying to set up our LDAP server so that members of the pwmadmins group can change people's passwords for them. To be more specific, we have PWM for Tomcat set up and are trying to let pwmadmins change people's passwords through that. But for some reason people in the pwmadmins group still don't have permission to change people's passwords.
Here is what the ALC section of the olcDatabase={1}hdb.ldif file looks like now (I've displayed all of it, even though I'm only concerned with section {0}):
olcAccess: {0}to attrs=userPassword,shadowLastChange
by dn="cn=pwmadmin,dc=cs,dc=school,dc=edu" write
by group.exact="cn=pwmadmins,ou=groups,dc=cs,dc=school,dc=edu" write
by anonymous auth
by self write
by * none
olcAccess: {1}to attrs=loginShell,gecos
by dn="cn=admin,dc=cs,dc=school,dc=edu" write
by self write
by * read
olcAccess: {2}to attrs=loginShell,gecos
by dn="cn=pwmadmin,dc=cs,dc=school,dc=edu" write
olcAccess: {3}to dn.base=""
by * read
olcAccess: {4}to *
by dn="cn=admin,dc=cs,dc=school,dc=edu" write
by * read
(New lines added for clarity.) I've checked the format with a few other similar questions on this site to make sure that I have the order, spacing, etc down right, but it's still not working. I have the memberOf filter installed, and I've confirmed that that's working correctly on PWM. And when I gave my UID the ability to change passwords, it worked correctly. So it's clearly something with the group syntax, but I'm not sure what. Any help is much appreciated!
EDIT: Found a solution - see below.