title: OpenLDAP editing userPassword attribute ACL
body: <p>I try to create user, which can read other users password. I try to edit ACL already present in openLDAP, so I wrote:</p>
  <pre><code>dn: olcDatabase={1}mdb,cn=config
  changetype: modify
  replace: olcAccess
  olcAccess: {1}to attrs=userPassword 
   by self write 
   by anonymous auth 
   by dn=&quot;cn=admin,dc=playground,dc=test,dc=local&quot; write 
   by dn=&quot;cn=usermanager,ou=cloud,o=customer1,dc=playground,dc=test,dc=local&quot; read 
   by * none
  </code></pre>
  <p>the only modification in above olcAccess ACL from my side is:
  <br />
  <strong>by dn=&quot;cn=usermanager,ou=cloud,o=customer1,dc=playground,dc=test,dc=local&quot; read</strong></p>
  <p>After I do that (via ldapmodify) I loose ability to browse ldap tree as usermanager, but I can login, exmaple:
  <br />
  <code>ldapsearch -x -D &quot;cn=usermanager,ou=cloud,o=customer1,dc=playground,dc=test,dc=local&quot; -W -LLL</code>
  <br />
  returns: <code>No such object (32)</code>
  <br />
  <code>ldapwhoami -x -D &quot;cn=usermanager,ou=cloud,o=customer1,dc=playground,dc=test,dc=local&quot; -W -LLL</code>
  <br/>
  returns: <code>dn:cn=usermanager,ou=cloud,o=customer1,dc=playground,dc=test,dc=local </code></p>
  <p>Question is: how to write this ACL to grant user <code>usermanager</code> rights to read other users password?</p>