ACL (Regex) help needed

[Denny Schierz <linuxmail@4lin.net>]

hi,

I have the following structure:

cn=foobar,ou=aliases,dc=domain1,ou=mail,ou=services,ou=department,dc=domain,dc=foo
cn=foobar1,ou=aliases,dc=domain2,ou=mail,ou=services,ou=department,dc=domain,dc=foo
cn=foobar2,ou=aliases,dc=domain2,ou=mail,ou=services,ou=department,dc=domain,dc=foo

cn=foobar likes like:

dn: foobar,ou=aliases,dc=domain1,ou=mail,ou=services,ou=department,dc=domain,dc=foo
objectClass: inetLocalMailRecipient
objectClass: person
objectClass: top
cn: admin
sn: admin
description: added_by_dekanat
mailLocalAddress: sysop@department.domain.foo
mailRoutingAddress: foobar@department.domain.foo

At the moment I have one role "mail" that has access to:

dn.sub="ou=mail,ou=services,ou=department,dc=domain,dc=foo" read

it works as expected, the mailserver can read all entries. 

Now I want to create a role, who has permissions to delete/add/modify all entries below ou=aliases, from all domains (dc=domain,ou=mail...), but only, if "description: <string>" is found (for delete/modify only, but not for add).

Is that possible?

Otherwise, how does it look, if I throw the idea with "only if" ?

cu denny