Openldap ldapmodify acl无效DN

我不明白为什么ldapmodify不接受我的GrantUseral2.ldif 我想证明ou=service，uid=dovecot可以读取用户密码。 不幸的是，ldapmodify甚至不接受简单的acl:D 我被错误缠住了：

ldapmodify -h localhost -p 389 -D "cn=admin,dc=example,dc=com" -w ****** -f /etc/ldap/grantuserall2.ldif
modifying entry "olcDatabase{1}hdb,cn=config"
ldap_modify: Invalid DN syntax (34)
additional info: invalid DN

grantuserall2.ldif:
dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {3}to *
    by self write
    by users read
    by * none

ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -w ******  olcDatabase={1}hdb
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=example,dc=com
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou
 s auth by dn="cn=admin,dc=example,dc=com" write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=com" write by * re
 ad
olcLastMod: TRUE
olcRootDN: cn=admin,dc=example,dc=com
olcRootPW: {SSHA}***********************************
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcDbIndex: uid pres,eq
olcDbIndex: cn,sn,mail pres,eq,approx,sub
olcDbIndex: objectClass eq

我的DIT与此类似：

我将感谢任何帮助。

---

晚安^

解决方案是在dn选择中使用a=

例如，而不是：

grantuserall2.ldif:
dn: olcDatabase{1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {3}to *
    by self write
    by users read
    by * none

做：

grantuserall2.ldif:
dn: olcDatabase={1}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {3}to *
    by self write
    by users read
    by * none