> 1) If this ACL is in the global context, per-database ACLs > will precede it. They may be giving read access. This gave me the hint I needed. Moving the ACL below "bdb cn=log" but above "bdb dc=soe,dc=ucsc,dc=edu" worked. Previously I had all my ACLs at the bottom of slapd.conf together, rather than divided out on a per-DB basis. Tim Gustafson BSOE Webmaster UC Santa Cruz tjg@soe.ucsc.edu 831-459-5354