I have the following openldap server configuration:
access to attrs=userPassword
by self write
by anonymous auth
by set="[cn=users,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
by * none
# Allow everybody adding and changing Contacts
access to dn.subtree="ou=Contacts,dc=my-company,dc=de"
by set="[cn=users,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
by * read
access to *
by self write
by dn.base="cn=admin,dc=my-company,dc=de" write
by set="[cn=sysadm,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" write
by * read
What it should do is this:
- allow everybody to change his own password
- allow all users to add and change contacts
- allow all in group "sysadm" to change everything
The problem is, the sysadms can not change any user password. Any hints?