I'm playing around with OpenLDAP servers with replication, and needed to set appropriate ACLs to give replication user to read everything in source host.
After reading this article created this set of rules:
olcAccess: {0}to * by dn.base="cn=admin,dc=example,dc=com" manage
olcAccess: {1}to * by dn.base="uid=rpuser,dc=example,dc=com" read
olcAccess: {2}to attrs=userPassword by self write by anonymous auth by * none
olcAccess: {3}to attrs=shadowLastChange by self write by * read
olcAccess: {4}to * by users read
What I wanted to achieve was:
- Admin can do everything, no limits
- Replication user can read everyting
- Users can change their passwords
- Any access to directory is possible only for logged in users, no anonymous access.
After setting above ACLs to server, replication user cannot login at all. I do not understand why this happens, Replication user DN is correct and as far as I know it should match...
Server logs after login attempt:
slapd[3475]: => access_allowed: result not in cache (userPassword)
slapd[3475]: => access_allowed: auth access to "uid=rpuser,dc=example,dc=com" "userPassword" requested
slapd[3475]: => acl_get: [1] attr userPassword
slapd[3475]: => acl_mask: access to entry "uid=rpuser,dc=example,dc=com", attr "userPassword" requested
slapd[3475]: => acl_mask: to value by "", (=0)
slapd[3475]: <= check a_dn_pat: cn=admin,dc=example,dc=com
slapd[3475]: <= acl_mask: no more <who> clauses, returning =0 (stop)
slapd[3475]: => slap_access_allowed: auth access denied by =0
slapd[3475]: => access_allowed: no more rules
If I understand correctly, only first ACL is checked?