OpenLDAP monitor access ACL not working

Question

I'm unable to retrieve the monitor information with OpenLDAP running on CentOS 7. In order to set everything up I've followed the steps documented here:

$ cat module_monitor.ldif
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: {2}back_monitor

$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f module_monitor.ldif

confirming it worked:

 $ sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=module{0},cn=config"
 SASL/EXTERNAL authentication started
 SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
 SASL SSF: 0
 # extended LDIF
 #
 # LDAPv3
 # base <cn=module{0},cn=config> with scope subtree
 # filter: (objectclass=*)
 # requesting: ALL
 #

 # module{0}, config
 dn: cn=module{0},cn=config
 objectClass: olcModuleList
 cn: module{0}
 olcModulePath: /usr/lib64/openldap
 olcModuleLoad: {0}memberof
 olcModuleLoad: {1}refint
 olcModuleLoad: {2}back_monitor
 <...>

Next adding monitor account:

$ cat cn_monitor.ldif 
dn: cn=monitor,dc=company,dc=de
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: monitor
description: LDAP monitor
userPassword: {CRYPT}REDACTED

$ ldapadd -x -D "cn=admin,dc=company,dc=de" -W -f cn_monitor.ldif -ZZ -H ldap://openldap.internal.company.de

And finally configuring the ACL:

$ cat database_monitor.ldif
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=manager,dc=company,dc=de" read by * none

$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f database_monitor.ldif

confirming it worked:

$ sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b "olcDatabase={1}monitor,cn=config"

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <olcDatabase={1}monitor,cn=config> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# {1}monitor, config
dn: olcDatabase={1}monitor,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external
 ,cn=auth" read by dn.base="cn=manager,dc=company,dc=de" read by * none

Now I can retrieve the monitor information using EXTERNAL authentication with sudo:

$ sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=monitor"
<...>
# numResponses: 67
# numEntries: 66

Unfortunately I can't achieve the same with the monitor user:

$ ldapsearch -D "cn=monitor,dc=company,dc=de" -H ldap://openldap.internal.company.de -W -ZZ  -b "cn=monitor"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <cn=monitor> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 3
result: 32 No such object

# numResponses: 1

What am I missing here?

Answer 1

Your access list does not include cn=monitor,dc=company,dc=de. As such the dn you are trying to use is getting caught by the by * none part of your olcAccess rule. (Without this section the same thing would have happened implicitly rather than explicitly.)

The following ldif should work as desired:

dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to *
  by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
  by dn.base="cn=manager,dc=company,dc=de" read
  by dn.base="cn=monitor,dc=company,dc=de" read
  by * none