Re: Documentation request

[Russ Allbery <rra@stanford.edu>]

Howard Chu <hyc@symas.com> writes:

> So, for those of you using sets - why are they useful to you, and in what
> ways are they still too limited? I personally am concerned that they are
> too expensive to evaluate; if we could provide similar features using a
> less general model that would be worth exploring too.

I inherited this setup, so I don't know how useful it is or if there are
better ways of expressing the same thing, but we use it for:

access to dn.children="cn=people,dc=stanford,dc=edu"
        by set.exact="this/uid & user/uid" sasl_ssf=56 read

access to dn.children="cn=nis,dc=stanford,dc=edu"
        by set.exact="this/host & user" sasl_ssf=56 read

access to dn.children="cn=accounts,dc=stanford,dc=edu"
        by set.exact="this/uid & user/uid" sasl_ssf=56 read
        by * break

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>