Comment 3 for bug 538516

A few other notes:

Bug #526230 "On upgrade modifies multiple olcAccess definition are not handled correclty" is definitely related to this one. However, #526230 deals with a Jaunty->Karmic upgrade, and specifically mentions that the pre-upgrade configuration had multiple oldAccess lines (so presumably it had been customized locally). I created a separate bug here in case there is simple tweak to the slapd.postinst script that would allow the Hardy->Lucid upgrade to work, but which wouldn't fix #526230. On the other hand, a more comprensive solution of some sort could certainly resolve both bugs at the same time.

Also, I should mention that my goal when I added the "{1}" to the text of the new dn.exact=cn=localroot line was simply to make the smallest possible change needed get "dpkg" to think that the package installation had succeeded (so that it would stop trying to reconfigure the package every time I installed some other package, etc.).

I haven't actually tried doing anything with my LDAP database yet, but I as far as I understand the workings of the oldAccess lines, the dn.exact=cn=localroot line as it now exists is actually completely ignored, since the "{0}to * by * none" line will prevent any lines with higher sequence numbers from being processed.... So presumably the actual fix will have to take some other approach to getting past this error....