My understanding is that you want to confine in one rule all is required
to allow entry addition. This can be done at the cost of giving away more
Yes, my ACL configuration file is becoming too complicated (cue really
bad joke about ACLs breeding).
rights than strictly required. You need a <what> clause <dn> pattern that
matches both the parent and the newborn entry; in this case you can
simultaneously give access to "children", "entry" and "<attrlist>", at the
cost of giving the same access rights to the children of the newborn
entry, and to the parent's "entry" and "attrlist" attributes. In your
case, I guess the only option is to use (going back to your very initial
example):
access to dn.regex="^(([^,]+),)?cn=([^,]+),CN=FOO$"
attrs=entry,children,@pilotPerson
by dn.exact,expand="cn=$3,CN=FOO" write
This matches exactly "^cn=([^,]+),CN=FOO$" or a direct child of it. Hope
it helps.
Thanks, I'd prefer clear ACLs that are not overly permissive :-)
Note that in the first example, which is what I'm most keen to simplify,
the subject is not related to the object (the subject is a well known DN).
So there is no regex substitution needed.
All I want to do is allow this well known subject to create entries of a
particular class underneath another well known DN (and to be able to
create further entries subordinate to these newly created entries of the
same object class).
If I follow your logic, then will the following rule work (at the expense
of giving CN=BAR members access to the pilotPerson attributes of CN=FOO,
which I can live with)?
access to dn.subtree="CN=FOO" attrs=children,entry,@pilotPerson
by group/group/member.exact=CN=BAR
Or, the following, tighter rule:
access to dn.onelevel="CN=FOO" attrs=children
by group/group/member.exact=CN=BAR write
access to dn.children="CN=FOO" attrs=entry,@pilotPerson
by group/group/member.exact=CN=BAR write