Subordinate ACL question

[Luke Howard <lukeh@padl.com>]

Is the following sufficient to allow members of group cn=BAR to create
entries of objectClass favouriteDrink under cn=FOO? (Obviously the DNs
and object class are hypothetical.)

access to dn.children=cn=FOO attrs=children,entry,@favouriteDrink
	by group/group/member.exact=cn=BAR write

I'm a bit confused as the examples I've seen seem to show different
ACLs for access to children and entry. I'm using the following ACLs
successfully to allow principals to create subordinate entries to
themselves:

access to dn.regex="^cn=([^,]+),cn=FOO" attrs=children
	by dn.exact,expand="cn=$1,cn=BAR" write

access to dn.regex="^[^,]+,cn=([^,]+),cn=FOO" attrs=entry,@favouriteDrink
	by dn.exact,expand="cn=$1,cn=BAR" write

A corollary of my first question is whether these can be collapsed
to:

access to dn.regex="^cn=([^,]+),cn=FOO" attrs=children,entry,@favouriteDrink
	by dn.exact,expand="cn=$1,cn=BAR" write


-- Luke

--