Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a setup of OpenLDAP v2.3 which I am using for last few years. Following are the lines in slapd.conf for access control.

access to"o=abc, c=IN"
        by * read

access to dn.base="o=abc, c=IN"
        by * none

When I do ldapsearch using anonymous bind gives me result.

For example following command gives result.

ldapsearch -x -h localhost -b "o=abc,c=IN" 

Now I upgraded the OS, CentOS from 5.5 to 6.3 so the version of OpenLDAP is OpenLDAP v2.4. We have not changed the schema.

But now the same ldapsearch gives me result: 32 No such object error.

But it works when I added following line in access control configuration.

access to"o=abc, c=IN"
        by * read

access to dn.base="o=abc, c=IN"
        by anonymous read
        by * none

What can be the reason? Is there any security risk in doing so?

share|improve this question
up vote 1 down vote accepted

I posted the question on OpenLDAP mailing list and got the answer. Thanks to Pierangelo Masarati.

In OpenLDAP v2.4, search operation requires "search" privileges on the "entry" pseudo-attribute of the search base which was not the case in v2.3.

man slapd.access(5):


The search operation, requires search (=s) privileges on the entry pseudo-attribute of the searchBase (NOTE: this was introduced with OpenLDAP 2.4).


So I do not have to give read access to anonymous for base. Only search privilege is enough as following.

access to dn.base="o=abc, c=IN"
            by anonymous search
            by * none

I tested it successfully.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.