I have now done a little research. You can start multiple instances of the 389-ds. There is then a dse.ldif for each instance under /etc/dirsrv/... In this ldif you can set the following parameters: sslapd-localuser:% ds_user% If you do not use dirsrv here, but here, for example, kolab, then this requires write access to /var/lib/dirsrv, among other things. This user, kolab, must therefore be in the dirsrv group. Second, the group right from dirsrv to /var/lib/dirsrv must have write rights. Therefore it must change/fix in spec file from 389-ds. Correct me if I'm wrong. But if i am correct, please correct the right in the spec.