Re: what is wrong with my permissions?

[Ferenc Wagner <wferi@niif.hu>]

Igor Shmukler <igor.shmukler@gmail.com> writes:

> I understood that manage is the LDIF version of full permissions.

Yes, that goes further than write permission by allowing (eg.) the
relax rules control.  I couldn't find definitive documentation on this.

> dn: olcDatabase={0}config,cn=config
> changetype: modify
> replace: olcAccess
> olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external
>  ,cn=auth manage by * break
> olcAccess: {1}to * by self write by dn="cn=config" write by * read

Note that this rule allows generic write access to cn=config inside the
config database only.
http://www.openldap.org/devel/admin/slapdconf2.html#Access%20Control%20Evaluation

> when ldapdelete(1) is invoked, I get:
> ldap_delete: Insufficient access (50)
> additional info: no write access to parent

You don't tell, but your latest question suggests that you're trying to
delete an entry outside of cn=config, which is not covered by the above
olcAccess line.  What was your exact ldapdelete command?
-- 
Feri.