Openldap questions

[jbolek@interia.pl]

Hi,

 Since few days I try to make very simple ldap service. Directory contains only 3 attributes: cn, mail and sn with data of our customers. It is dedicate to make fast and simply 'people search' for e.g Outlook Express or TheBat! mail client. Problem is: responses should be returned only after specifying one of the valid arguments, e.g. sn,cn, or (mail=jdoe@openldap.org), and should reject querries like:
filter:(&(cn=*)(mail=*)).

ACL in slapd.conf are only filters for output not for the incoming querries, as I think (after many hours spent on debugging). Therefore I have executed emergency plan - with the usage of two servers. The first is located in the intranet and contains database, the second is located within the public network, serving as gateway for the database. This also doesn't work because external server does not transfer the querries to database. Tests performed on default slapd-ref-slave.conf, in accordance with admin guide, turn negative. Referal seems not to work in openldap 2.0.23-2.0.25 based on default openldap config files.

I have read all the documentation from openldap project (IMHO) and I can't find the resolution of the problem mentioned. Is there any way to resolve this ?

Best regards,