openldap ACLs

[Holtom, Roger]

I’m trying to get a version 2.4.0 of IdP running.  I was having some issues when using sp.testship.org.  My directory is openldap 2.4.31 (I also have 2.4.36 running if that becomes a factor in my issue).  We have a number of ACLs in the openldap config, and the ldap error log indicated that these were the issue.  So on a test ldap I made all attributes readable by anonymous.  That allowed a successful test against testshib.org’s SP.  I’m sure I’m overlooking something (probably simple!), and we do need to keep some of our attributes controlled as to who has access.  Any ideas on what I should be doing?

Roger Holtom
Systems Engineer, Directory Services
The University of Montana
roger.holtom at umontana.edu