The last day and a half, I’ve been wrestling with the meta and ldap backends to OpenLDAP (back-meta and back-ldap). Thanks to the chief developer of these backends who shed lots of light on the issue, and thanks to an upgrade to 2.3.12, I won the fight. If you are so inclined, you can follow the conversation thread. Now for some heavy ACL writing… :-)