Re: grant access on a attribute specific value

[Tobias FranzÃn <lists.zxinn@otaking.se>]

Fabrice Eudes wrote:
> Hi all,
>
> I am runing an openldap 2.4.7 on debian with small local schema 
> modifications: a few more attributes and an objectClass derived from 
> inetOrgPerson.
>
> I have looked in the administrator's guide and the slapd.access 
> manpage but I can't figure out how to do the following: I want to give 
> write access depending on the value of an attribute.
>
> something like:
> access to dn="cn=foo,ou=groups,dc=example,dc=com"
>              attrs=cn,description,memberUid,entry
>        by (&(objectClass=inetOrgPerson)(employeeType=chief)) write
>
> If I have read the manpage correctly, I can't do it with a filter. Is 
> there any way to get this behavior ?
>
> It is not clear for me if the "dynacl" I saw in the manpage:
> - can solve this problem
> - are compulsory to solve it
>
> any help ? example ?
>
> thanks.

I am not sure how to do exactly what you ask, but an alternative would
be to use the "group" <who> clause.

If all your "chiefs" are in a common group, just add:
   by group.exact="cn=Chiefs,ou=Groups,dc=example,dc=com" write

/Tobias