Add default ACLs to map root user with LDAPI

[coudot]

It is useful to be able to use ldapi:// with linux root account to manage OpenLDAP config and data (for example with ldapvi).

We should add this in default configuration:

dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * none
olcRootDN: cn=config

dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /usr/local/openldap/var/openldap-data
olcLimits: {0}dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth size=unlimited time=unlimited
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage

[davidcoutadeur]

Feature seems ok with:

• 2d622c7 : add missing access to cn=config database to root (by default, acls of cn=config, even if appended with global acls from frontend, are restricted to rootdn). We may have added a olcAccess to * by * break, but it seems to weak
• 382f532 : fix security strength factor, preventing root access
• 4e87162 : add unlimit for root access everywhere in playbook examples

[coudot]

Root must also have access to data

Don't know if there is any need to give manage rights to root on cn=monitor

[davidcoutadeur]

Root must also have access to data

Don't know if there is any need to give manage rights to root on cn=monitor

Indeed, it seems reasonable to add rights for root user to read cn=monitor.

write or manage is not really useful here as this is a read only database, isn't it?

[davidcoutadeur]

Root must also have access to data

I think this is already the case. You can give a look to multimaster.yml for example