Re: ACL Question 'write stop' 'write break'

[Aaron Richton <richton@nbcs.rutgers.edu>]

slapd -d acl (or the same through loglevel directives) is really helpful 
if you're not already using that...

First off, "attr=" is not preferred, please see slapd.access man page. 
This should be logged at LDAP_DEBUG_ANY; are you reading your startup 
logs? You might as well do a "slaptest -d config" while you're at it, to 
make sure everything is clean.

So when you uncomment your first stanza and consider the second stanza 
too:

access to dn.regex="mail=.*.managed@jointhegrid.com,ou=user,ou=jointhegrid.com,o=jointhegrid,c=US"
  attrs=userPassword,accountstatus
  by dn="mail=john@jointhegrid.com,ou=user,ou=jointhegrid.com,o=jointhegrid,c=US" write break
  by dn="mail=sara@jointhegrid.com,ou=user,ou=jointhegrid,o=jointhegrid,c=US" write break
access to attr=userPassword
  by self write
  by anonymous auth
  by dn="mail=samba@jointhegrid.com,ou=user,ou=jointhegrid.com,o=jointhegrid,c=US" read
  by dn="mail=samba@jointhegrid-inc.com,ou=user,ou=jointhegrid-inc.com,o=jointhegrid,c=US" read
  by * none

you're not giving john@ and sara@ your desired write access? I think that 
although rule #1 may will fire and grant them write, rule #2 has "to *" as 
the implicit target (IMO a best practice is to write these out), so it 
will fire as well. The first four <by> will not apply to john@ and sara@, 
so the final <by> will fire ... by * none. ACL #1 giveth, ACL #2 taketh 
away. I think a first consideration would be giving john@ and sara@ "write 
stop" instead of "write break" -- the break means to continue evaluation, 
whereas "stop" will not let ACL #2 remove the effect of ACL #1.

> by * break

Also IMO best practice, "by * none break" (or whatever level you want) to 
make the level explicit. And you'll obviously need to keep this; otherwise 
.*managed will never be able to auth (they have to get to ACL #2 <by> #2 
by means of a "break" or ACL reordering).