OpenLDAP Access handling

I have installed OpenLDAP on Ubuntu Server 20.04. It works fine so far. Now I want to restrict access to the server, as by now anyone can read all entries e.g. in Thunderbird. Therefore I created a ldif file like this:

dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: to attrs=userPassword
  by self write
  by anonymous auth
  by * none
olcAccess: to attrs=shadowLastChange
  by self write
  by * read
olcAccess: to * by * read

which is the standard configuration. Anyhow if I change the last entry to something else, e.g.

olcAccess: to * by users read

I cannot access LDAP in Thunderbird anymore. What I want is that Thunderbird asks for a username and password before it shows anything. In Thunderbird there are 5 fields to set:

Name              Any Name for the LDAP
Server address    DNS address
Base-DN           e.g. dc=example,dc=org   
Port-Number       636 
Bind-DN           ?? 

If i put nothing in the Bind-DN, Thunderbird does not ask for anything but also does not show anything. If I put my username or userid in it, it ask for a password but nothing is shown again.

I got two question:

• How should the ldif look like?
• What has to be put into Thunderbird?

"Bind DN" is the name of a directory entry used in the login (bind) operation. In LDAP, there are no separate user IDs – instead your entries themselves are the LDAP accounts.

For example, cn=Arne Fallisch,ou=Staff,dc=example,dc=org would be your "Bind DN" (assuming it exists, of course), and the entry's userPassword attribute would be your password.

(The attribute can contain a hashed password; the slappasswd command can be used to generate a compatible password hash, or ldappasswd can be used to change the password online.)

Any entry regardless of its objectClass can be used for binding to the directory, as long as it has the userPassword attribute – this includes 'person', 'inetOrgPerson', 'posixAccount' and a few others.

Note that OpenLDAP ACLs work in "stealth" mode by default – that is, instead of saying "Access denied", the server pretends the unavailable entries don't exist at all. When protecting a whole server you probably would prefer it to just return an "Authentication is needed" error instead – to achieve this, define olcRequires: bind authc in your olcDatabase entry (but not in the global config entry; doing so would break things like StartTLS and SASL authentication).