Re: ACL filters

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 05:23 PM 6/30/99 +0200, Emmanuel JEGOU wrote:
>Hello,
>
>I try to manage access controls on entries under ou=people,o=Naonet
>Company,c=fr entry to only one person for the moment.
>My problem occurs when I want to manage access to entries with the
>attribut value equal to 'Personnel'. Only the entries that verify this
>condition can be accessed.

It looks like Rule 2 should do the trick.  When you tested it was
it the first rule in slapd.conf?   Remember that only the first
matched "what" clause of the first matched "who" clause matters.  If
no "what" clause matches of the first matched "who" clause, the
default rule is applied.  If no "who" cause matches, the default
rule is applied.

Rule 1 and 3 have a bogus filters.  You cannot match DN nor use regular
expressions in search filters.  Use ldapsearch to verify your search
filters before attempting to use them in ACLs.

I recommend you look at using dnattr and group based ACLs.