title: Struggling with OpenLDAP configuration (on AWS EC2)
body: <p>I've been configurating a LDAP server on a linux instance using AWS EC2.
  Up to now, I successfully set up LDAP and phpLDAPadmin to work together.</p>
  
  <p>I've created Users and Groups "Organisation Units". I've added users and groups to those "OU"s.
  Now I want to grand access to specific parts of my LDAP tree to the "Users" members of a "Group". That's what I wasn't able to configure up to now...</p>
  
  <p>My LDAP tree looks like this:</p>
  
  <pre><code>+--&gt; dc=www,dc=website,dc=com (3)
    ---&gt; cn=admin
    +--&gt; ou=groups (4)
    | ---&gt; cn=admin_users
    | ---&gt; cn=app1_users
    | ---&gt; cn=app2_users
    | ---&gt; cn=basic_users
    +--&gt; ou=users (3)
    | ---&gt; cn=user1
    | ---&gt; cn=user2
    | ---&gt; cn=user3
  </code></pre>
  
  <p>Let's say that I added user1 + user2 to the "memberUid" list of "app1_users" and user2 + user3 to the "memberUid" list of "app2_users".</p>
  
  <p>I want:</p>
  
  <ul>
  <li>cn=admin have full rights/access to the tree</li>
  <li>app1_users can connect (to phpLDAPadmin) and add new members to the the group itself</li>
  <li>the same for app2_users' users</li>
  </ul>
  
  <p>A connected user (on phpLDAPadmin) should only see the tree (and child substrees) he's part of.</p>
  
  <p>Here are the ACI I tried (but whose were obsiouvly not working):</p>
  
  <pre><code>access to attrs=shadowLastChange
      by self write
      by dn="cn=admin,dc=www,dc=website,dc=com" write
      by * read
  
  access to attrs=userPassword
      by self write
      by dn="cn=admin,dc=www,dc=website,dc=com" write
      by anonymous auth by * none
  
  access to dn.base=""
      by * read
  
  access to dn.subtree="cn=app1_users,ou=groups,dc=www,dc=website,dc=com"
      by group.base="cn=app1_users,dc=www,dc=website,dc=com" write
      by dn.base="cn=admin,dc=www,dc=website,dc=com" write 
      by * none
  
  access to dn.subtree="cn=app2_users,ou=groups,dc=www,dc=website,dc=com"
      by group.base="cn=app2_users,dc=www,dc=website,dc=com" write
      by dn.base="cn=admin,dc=www,dc=website,dc=com" write 
      by * none
  
  access to *
      by self write
      by dn="cn=admin,dc=www,dc=website,dc=com" write
      by * read
  </code></pre>
  
  <p>Is there something wrong with my configuration ?</p>