Re: filters in ldapACI (WAS Re: I-D ACTION:draft-ietf-ldapext-acl-model-06.txt)

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 05:30 PM 7/21/00 +0200, Rob Byrne - Sun Microsystems wrote:
>I think the question was rather how to make an aci grant access as a function of the value of the objectclass attribute in it's entry.

Fair enough.

>In the example, both objectclasses allow the cn attribute but we want the aci to apply in one case but not the other.

Okay.  Content based ACIs... hmmm.... seems this might cause a few wrinkles
(or at least add a lot of complexity).

>> distinguish by objectclass ( I may want to expose cn for
>>     inetorgperson but not for
>>      residentialperson by default).