Help with LDAP and Leopard

I have OpenLDAP configured on my RedHat server, and am able to authenticate users on the MAC with the LDAP plugin in DirectoryService.

Initially, for testing, I had no ACLs at all on the OpenLDAP server. Everything works. The moment I add these two ACLs:

access to attrs=userPassword
by * auth

access to *
by * read

… no user can login.

I know that the problem is the first ACL because if I comment it out, the logins work.

If I have the MAC authenticate as the “root”/manager, it works as well.

I’m using just standard crypt passwords, no SASL, no Kerberos. This seems trivial. I’ve seen this syntax used to block user access to “userPassword” across the directory in about a billion places on the web. I just don’t understand why it’s not working for me.

From the log:

==> bdb_bind: dn: uid=user,ou=People,dc=cse,dc=yorku,dc=ca
bdb_dn2entry(“uid=user,ou=people,dc=cse,dc=yorku,dc=ca”)
=> access_allowed: auth access to “uid=user,ou=People,dc=cse,dc=yorku,dc=ca” “userPassword” requested
=> acl_get: [1] attr userPassword
=> slap_access_allowed: result not in cache (userPassword)
=> acl_mask: access to entry “uid=user,ou=People,dc=cse,dc=yorku,dc=ca”, attr “userPassword” requested
=> acl_mask: to value by “”, (=0)
<= check a_dn_pat: * <= acl_mask: [1] applying auth(=xd) (stop) <= acl_mask: [1] mask: auth(=xd) => slap_access_allowed: auth access granted by auth(=xd)
=> access_allowed: auth access granted by auth(=xd)
send_ldap_result: conn=2 op=1 p=3
send_ldap_result: err=49 matched=”” text=””
send_ldap_response: msgid=2 tag=97 err=49

Any idea?

I would really appreciate any help.

Kangaman