[LUNI] LDAP write access

[sten]

sort of tangentially related to my earlier mailserver questions, I'm trying to set up personal addressbooks in an LDAP database, and I'm running into permissions issues. Eventually, I want to use regexes to match users to their own ou, but for now I have:

access to dn="ou=sten,ou=contacts,dc=redboy,dc=cx"
        by dn="uid=sten,ou=users,dc=redboy,dc=cx" write
        by * none

in my slapd.conf, but when I try adding an entry, I get an error saying "Insufficient access:"

sten at fenris2:~$ ldapadd -D uid=sten,ou=users,dc=redboy,dc=cx -W -x -v -f test
ldap_initialize( <DEFAULT> )
Enter LDAP Password:
add cn:
        Barbara Jensen
        Babs Jensen
add sn:
        Jensen
add title:
        the world's most famous mythical manager
add mail:
        bjensen at example.com
add givenName:
        Barbara Jensen
add objectClass:
        inetOrgPerson
adding new entry "cn=Barbara Jensen,ou=sten,ou=contacts,dc=redboy,dc=cx"
modify complete
ldap_add: Insufficient access (50)
        additional info: no write access to parent

I've tried "access to dn.subtree" and a bunch of other permutations inspired by the manpage for slapd.access, all with the same error; can anyone tell me what I'm missing?

Thanks!
-sten