problem with simple subtree acl

[<joerg.fritsch@planet-interkom.de>]

Hello,

I'm running openLDAP v3 on SuSE Linux.
I have a tree like this:::

net
 |
 >company
    |
    >admins
    |
    >users_1st_floor
    |
    >users_2nd_floor

Now I want to define an admin for each floor. And the admin (DN: 
cn=Admin_Name, ou=admins, o=company, c=net) should only be able to see / 
fetch his own branch (like DN: ou=users_1st_floor,o=company,c=net).

I'm using the attached slapd.conf ... but I always get the error 50. I 
haven't sufficient access. Is there something worng with my acls ??

Thanks
--Joerg

 
# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.6 2001/04/20 23:32:43 
kurt Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/fw1_phoneb.cfg

schemacheck	on
# schemacheck	off 
# needs top be turned off for the very first entry

TLSCipherSuite		HIGH:MEDIUM:+SSLv2	
TLSCertificateFile	/etc/openldap/mozart.pem	
TLSCertificateKeyFile		/etc/openldap/mozart.pem


# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/var/run/slapd.pid
argsfile	/var/run/slapd.args


# Load dynamic backend modules:
# modulepath	/usr/lib/openldap/openldap
# moduleload	back_ldap.la
# moduleload	back_ldbm.la
# moduleload	back_passwd.la
# moduleload	back_shell.la

#######################################################################
# ldbm database definitions
#######################################################################

database	ldbm
#suffix		"dc=my-domain,dc=com"
suffix		"o=company,c=net"
#rootdn		"cn=Manager,dc=my-domain,dc=com"
rootdn		"cn=Creator,o=company, c=net"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw		{crypt}********
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd/tools. Mode 700 recommended.
directory	/var/lib/ldap
# Indices to maintain
index	objectClass	eq

access to * by dn="cn=admin_name, ou=admins, o=company, c=net" read

access to dn="ou=users_1st_floor, o=company, c=net"
	by dn="cn=admin_name, ou=admins, o=company, c=net" write