Re: ldap queries rewriting

[Aaron Richton <richton@nbcs.rutgers.edu>]

If the copier has a Bind DN option, then something along the lines of...

access to dn.subtree="ou=Engineering,dc=example,dc=com"
  by dn.exact="cn=EngineeringCopier,ou=Engineering,dc=example,dc=com" read
  by [...everythingelse...]

access to *
  by dn.exact="cn=EngineeringCopier,ou=Engineering,dc=example,dc=com" none
  by [...everythingelse...]



If it doesn't, you could substitute the "dn.exact" with "peername.ip." 
Super disgusting, but it'd probably work.

(NOTE: if you're going to write back "they're all in ou=People" try

access to dn.subtree="ou=People,dc=example,dc=com"
  filter="(dept=Engineering)"
  by dn.exact="cn=EngineeringCopier,ou=Devices,dc=example,dc=com" read
  by [...everythingelse...])