about frequently used ACLs

["Pierangelo Masarati" <ando@sys-net.it>]

A frequent use of ACL is in the form:

"allow access to entries that reside
in a subtree (or exactly one level
below a subtree) and whose RDN is
made of a single AVA, with a given
attributeType."

It's not easy to generate effective
regexps for this case, and there are
more efficient means to handle this
case.

So I suggest a DN style modifier that
states something like this:

"access to DN below some subtree (with
one, subtree or children granularity)
whose [at least one] RDN attributeType
is <attr>, where "at least one" is
optional.

Something like:

dn.{onelevel,subtree,children},ava[,multivalued] \
        =<attr>;<pattern>

the same could apply to the <who> clause.

Comments?

Ando.

-- 
Pierangelo Masarati
mailto:pierangelo.masarati@sys-net.it