我想在LDAP中创build通讯录（对于邮件客户端，我的RoundCube的第一步）。 服务器是Debian 7.9，slapd 2.4.31（OpenLDAP）。 成功安装后，我为地址簿创build了一个子树：
dn: ou=rcabook,dc=mydomain,dc=com ou: rcabook objectClass: top objectClass: organizationalUnit dn: ou=public,ou=rcabook,dc=mydomain,dc=com ou: public objectClass: top objectClass: organizationalUnit dn: ou=private,ou=rcabook,dc=mydomain,dc=com ou: private objectClass: top objectClass: organizationalUnit 以及RoundCube的常规用户：
dn: cn=rcuser,ou=rcabook,dc=mydomain,dc=com cn: rcuser objectClass: organizationalRole objectClass: simpleSecurityObject userPassword:: e1f2g3....x3y2z1
但是当我想做一个新的入门作为rcuser，我有这个错误：
ldapadd -f entry.ldif -D cn=rcuser,ou=rcabook,dc=mydomain,dc=com -W Enter LDAP Password: adding new entry "cn=DOMAIN IT,ou=public,ou=rcabook,dc=mydomain,dc=com" ldap_add: Insufficient access (50) additional info: no write access to parent
ou = public，ou = rcabook子树在config中有一个特殊的访问权限：
# slapcat -n0 dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=mydomain,dc=com olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou s auth by dn="cn=admin,dc=mydomain,dc=com" write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=mydomain,dc=com" write by * read olcAccess: {3}to dn.subtree="ou=public,ou=rcabook,dc=mydomain,dc=com" by users writ e olcLastMod: TRUE ...
我需要添加哪些权限，对于所有用户都将添加到子树的条目？
谢谢，
一个。
从OpenLDAP ACL文档 ：
To add or delete an entry, the subject must have write access to the entry's entry attribute AND must have write access to the entry's parent's children attribute.
所以你需要授予对entry和children虚拟属性的访问权限：
olcAccess: {3}to dn.entry="ou=public,ou=rcabook,dc=mydomain,dc=com" by users write olcAccess: {4}to dn.children="ou=public,ou=rcabook,dc=mydomain,dc=com" by users write