(ITS#4552) Cannot add a dc=net with a rootdn equivalent account

[ashish@ratboy.net]

Full_Name: Ashish Gawarikar
Version: 2.3.21
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (63.211.143.38)


This seems to be a regression from openldap 2.1.x which was the last one I
used.

Here is the part of slapd.conf:
----

access to *
        by group/smiAdminGroupOfNames="cn=Directory Site Administrators,ou=SMI
Administrators,dc=admin,dc=local" write stop
        by * break

#rootdn  "cn=Manager"
#rootpw  whatever

suffix          ""

----

I generally keep the rootdn/rootpw commented. And use the member of the group
Site Administrators to add a new account. A new domain "x.com" can be added if
the dc=com entry pre-exists. If dc=com does not pre-exist I cannot add the x.com
domain using the member of the group Site Administrators.

Here is what I get:

# /usr/local/openldap/bin/ldapadd -Z -H ldap://:389/ -x -c -D
uid=admin,ou=sysAccounts,dc=admin,dc=local -w dmin < /justnet
adding new entry "dc=net"
ldap_add: No such object (32)

dn: dc=net
objectClass: top
objectClass: domain
dc: net


This used to work with openldap 2.0.x and 2.1.x

So I need to add the tld using rootdn/rootpw else I am never able to add any
tlds using the equivalent account. I have disabled the rootdn/rootpw access for
security purposes.