OpenLDAP - user cannot login after ACL rules change

Question

I'm playing around with OpenLDAP servers with replication, and needed to set appropriate ACLs to give replication user to read everything in source host.

After reading this article created this set of rules:

olcAccess: {0}to * by dn.base="cn=admin,dc=example,dc=com" manage
olcAccess: {1}to * by dn.base="uid=rpuser,dc=example,dc=com" read
olcAccess: {2}to attrs=userPassword by self write by anonymous auth by * none
olcAccess: {3}to attrs=shadowLastChange by self write by * read
olcAccess: {4}to * by users read

What I wanted to achieve was:

1. Admin can do everything, no limits
2. Replication user can read everyting
3. Users can change their passwords
4. Any access to directory is possible only for logged in users, no anonymous access.

After setting above ACLs to server, replication user cannot login at all. I do not understand why this happens, Replication user DN is correct and as far as I know it should match...

Server logs after login attempt:

slapd[3475]: => access_allowed: result not in cache (userPassword)
slapd[3475]: => access_allowed: auth access to "uid=rpuser,dc=example,dc=com" "userPassword" requested
slapd[3475]: => acl_get: [1] attr userPassword
slapd[3475]: => acl_mask: access to entry "uid=rpuser,dc=example,dc=com", attr "userPassword" requested
slapd[3475]: => acl_mask: to value by "", (=0)
slapd[3475]: <= check a_dn_pat: cn=admin,dc=example,dc=com
slapd[3475]: <= acl_mask: no more <who> clauses, returning =0 (stop)
slapd[3475]: => slap_access_allowed: auth access denied by =0
slapd[3475]: => access_allowed: no more rules

If I understand correctly, only first ACL is checked?

Answer 1

Those ACLs are not tested but should work:

olcAccess: {0}to * by dn.base="cn=admin,dc=example,dc=com" manage by * break
olcAccess: {1}to * by dn.base="uid=rpuser,dc=example,dc=com" read by * break
olcAccess: {2}to attrs=userPassword by self write by anonymous auth by * none
olcAccess: {3}to attrs=shadowLastChange by self write by * read
olcAccess: {4}to * by users read

You'll need by * break in first two rules so if there is no match in specific by clause next rule will be checked. You don't need by * break in the attrs=userPassword or attrs=shadowLastChange -- there should be no fallback to to * by users read.