How to add ACIs to OpenLDAP properly

Question

So I'm trying to get some ACIs added to my OpenLDAP system (hosting on CentOS 6). I've read how others put their ACIs in bdb like so...

olcAccess: to attrs=userPassword,shadowLastChange by dn="cn=manager,dc=bromosapien,dc=net" write by anonymous auth by self write by * none
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=manager,dc=bromosapien,dc=net" write by * read

However, I want to avoid that and just allow the password changes to happen from a container (and at least avoid using Directory manager). I read someone doing this which works from their perspective:

dn: ou=People,dc=bromosapien,dc=net
changetype: modify
add: aci
aci: (targetattr = "userpassword || telephonenumber")(version 3.0; acl "Allow self entry modification"; allow (write)(userdn = "ldap:///self");)

Problem is, trying to add it, I get this.

# ldapadd -xWD "cn=manager,dc=bromosapien,dc=net" -f aci-password.ldif 
Enter LDAP Password: 
modifying entry "ou=People,dc=bromosapien,dc=net"
ldap_modify: Undefined attribute type (17)
        additional info: aci: attribute type undefined

I must be doing something wrong or mentioning a wrong objectclass, etc. The question is, should I really be doing everything in bdb.ldif or is this possible to add ACIs that way and whatever method is "recommended" in this case, what's a better way to provide the ACIs I need to allow a user to change their own password (without the need of the directory manager)?

Edit: I also noticed with the olcAccess lines, ldapsearch doesn't show the userPassword line from an anonymous search.

Answer 1

Figured out that it's probably better to just do it the bdb.ldif way. What I did was like the above, but I made a few changes.

olcAccess: {0}to attrs=userPassword,shadowLastChange,loginShell by dn="cn=manager,dc=bromosapien,dc=net" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=manager,dc=bromosapien,dc=net" write by group.exact="cn=LDAPADMIN,ou=Group,dc=bromosapien,dc=net" write by * read

What I did instead was, I labeled each line with braces and a number. I also added the ability for a user to change their login shell (because I allow Bash, ksh, and zsh, we default to bash). I then created a groupOfNames container inside of the Group OU. Like this.

dn: cn=LDAPADMIN,ou=Group,dc=bromosapien,dc=net
objectClass: groupOfNames
objectClass: top
cn: LDAPADMIN
member: uid=zera,ou=People,dc=angelsofclockwork,dc=net
member: uid=sithlord,ou=People,dc=angelsofclockwork,dc=net

Of course, this requires the memberOf overlay.

The memberOf overlay I used is below:

% vi modules.ldif

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: memberof

% vi memberof.ldif

dn: olcOverlay=memberof,olcDatabase={2}bdb,cn=config
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: olcConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf