You are correct that ldapmodify-style changes are the intent of back-config. Note that in 2.4, back-config supports full ACLs. You might want to start your debugging there; perhaps you are missing permissions? Once you get your ldapsearch working at the command line, you can move on to the GUI.
--Quanah
--
Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration