Problems configure access-lists

[Andreas Dahlen <andreas@dahlen.ws>]

Hi!

I'm running OpenLDAP 2.3.19.

Our LDAP-structure is as below;

ou=admin,dc=example.dc=com
  cn=admlocal (objectclass=person)
  cn=admmaster (objectclass=simpleSecurityObject, organizationalRole)
ou=deps,dc=example.dc=com
  dep=dep1 (objectclass=locDep)
    cn=admin (objectclass=locAdmin)
    locId=ID11 (objectclass=locData)
    locId=ID12 (objectclass=locData)
    locUsr=USR11 (objectclass=locUser)
    .
    .
    .
  dep=dep2 (objectclass=locDep)
    cn=admuser (objectclass=locAdmin)
    locId=ID21 (objectclass=locData)
    locId=ID22 (objectclass=locData)
    locUsr=USR21 (objectclass=locUser)

Objectclasses locDep, locAdmin, locData and locUser are locally  
defined classes.

Everything works fine right now, but when I looked in sklapd.conf I  
saw a major configuration error;
The access-lists states;

access to attrs=userPassword
        by dn="cn=admmaster,ou=admin,dc=example,dc=com" write
        by anonymous auth
        by self write
        by * none

access to *
        by dn="cn=admlocal,ou=admin,dc=example,dc=com" write
        by dn="cn=admmaster,ou=admin,dc=example,dc=com" write
        by * write

I wants to tighthen this security but I can't figure out how I should  
configure my access-lists.

* cn=admmaster,ou=admin,dc=example.dc=com
Should have full access to everything

* cn=admlocal,ou=admin,dc=example.dc=com
Should have full access to everything, except userPassword

* cn=<username>,dep=<dep>,ou=deps,dc=example.dc=com
Should have full access to everything below its dep, i.e.
- cn=admin,dep=dep1,ou=deps,dc=example.dc=com should have full access  
to everything below dep=deop1,ou=deps,dc=example.dc=com and read on  
dep=deop1,ou=deps,dc=example.dc=com.
- cn=admuser,dep=dep2,ou=deps,dc=example.dc=com should have full  
access to everything below dep=dep2,ou=deps,dc=example.dc=com and read  
on dep=dep2,ou=deps,dc=example.dc=com.

The name of (class) locAdmin can be different in different deps.

I hope that I've managed to describe what I wants to achive.

/Andreas


----------------------------------------------------------------
This message was sent using IMP (http://www.horde.org).
Running on PHP 5.1.2, Apache 2.0.55, Ubuntu Dapper.