set ACL specification/syntax

[Andrew Cobaugh <phalenor@gmail.com>]

Hi all,

I'm trying to set up 'personal' groups with ACLs that allow my users
to directly create and modify their own personal group. For me,
personal groups are of the form
"cn=uid:groupname,ou=group,dc=mydomain"

So far I've had partial success. If the group already exists, the user
can modify that entry.

What I'm struggling with is how to allow authenticated users to create
entries of the form uid:foo under the group ou, i.e. grant write
access to the children of ou=group.

I *think* I can use "by set=<something>", but I haven't quite gotten
the grasp of it, and there are very few references to using 'set'
online (at least that I've found).

I was hoping someone on this list has either done something like this
before, or could point me in the right direction.

I think the set clause should at least be based on something like,
set="this/cn & user/uid" but with extra stuff in there to require a
colon and one or more characters only.

Ideas?

--andy