slapd-meta and acls

[Irina Shetukhina <irka@masterhost.ru>]

Hi.

I have meta-backend o=vega and two databases o=vega-main and ou=devel on the same server.
I'd configure meta-backend o=vega with

suffixmassage   "o=vega" "o=vega-main"
and
suffixmassage   "ou=devel,ou=sites,o=vega" "ou=devel"

I'd like to write acls per database, but provide DIT as single suffix
o=vega.

Members of cn=sysadmins,ou=groups,o=vega (really
cn=sysadmins,ou=groups,o=vega-main) should grant write permissions
to ou=devel,ou=sites,o=vega (really ou=devel). But
they grant only read to o=vega.

Where am I wrong?

My slapd.conf:

database        meta
suffix          "o=vega"
uri             "ldap://ldap.irka.int.masterhost.ru/ou=devel,ou=sites,o=vega";
suffixmassage   "ou=devel,ou=sites,o=vega" "ou=devel"
rootdn          "cn=ldapadm,o=vega"
rootpw          X
uri             "ldap://ldap.irka.int.masterhost.ru/o=vega";
suffixmassage   "o=vega" "o=vega-main"

database        hdb
suffix          ou=devel
rootdn          "cn=ldapadm,ou=devel"
rootpw          XX
directory       /var/db/openldap-data/devel
checkpoint      32 8

access to dn.sub="ou=devel"
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,ou=vega-main" write
        by * read

database        hdb
suffix          o=vega-main
rootdn          "cn=ldapadm,o=vega-main"
rootpw          XXX
directory       /var/db/openldap-data/vega-main
checkpoint      32 8

access to
        dn.sub="ou=SUDOers,o=vega-main"
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write
        by users read

access to
        dn.sub="ou=mail,o=vega-main"
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write
        by users read

access to
        dn.regex="ou=.*,ou=groups,o=vega-main"
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write
        by users read

access to
        dn.sub="ou=groups,o=vega-main"
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write
        by users read

access to
        dn.sub="ou=users,o=vega-main" attrs=userPassword
        by self write
        by anonymous auth
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write

access to
        dn.sub="ou=users,o=vega-main" attrs=mail
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write
        by users read

access to
        dn.sub="ou=users,o=vega-main" attrs=@inetOrgPerson,@inetLocalMailRecipient,@intraPerson,cn
        by self write
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write
        by users read

access to
        dn.sub="ou=users,o=vega-main"
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write
        by users read

access to
        dn.sub="o=vega-main"
        by anonymous auth
        by group/groupOfUniqueNames/uniqueMember="cn=sysadmins,ou=groups,o=vega-main" write
        by * read


My openldap version 2.4.11 on FreeBSD 7.0-amd64.

-- 
Irina Shetukhina