Re: (ITS#7495) access filter not correctly validated if assertion attribute not requested

[michael@stroeder.com]

Sorry for the confusion caused by editing what I've copied from the real
system before which uses a group for several Samba DC instances.

In this example the ACL part should be more simple like this:

access to
  dn.subtree="o=example"
  attrs=sambaNTPassword
  filter="(organizationalStatus=0)"
    by dn.exact="uid=samba_dc,o=example" write
    by group="cn=slapd Admins,ou=groups,o=example" =sw
    by self =w
    by * none

Ciao, Michael.