"Hide" certain DNs

["Andrew Cobaugh" <phalenor@gmail.com>]

I'm looking for a way to prevent a specific DN from a remote server
from showing up when being accessed through back-ldap (specifically,
slapo-translucent).

I have tried something like this:

access to dn.base="cn=psu.facstaff,dc=psu,dc=edu"
    by * none

This actually ended up preventing other dn's from showing up.

If I prevent only attrs=member,memberUid, that mostly works, but I
take it the ACLs are being applied after it has already searched, so
it still takes forever to return (one of my mac clients is taking
close to a minute to enumerate group membership because of this).

For anyone that's curious, the reason for doing this is psu.facstaff
is a group, and it has something around 64k attributes on it, which is
bringing my local openldap server to its knees sadly.


-- 
Andy Cobaugh