ACL to allow an attribute to be cleared, but not changed to something else?

[Tim Gustafson <tjg@soe.ucsc.edu>]

Hi,

I'd like to let my account managers to clear the passwords of their managees in the event that an employee is no longer active.  So, I've got an ACL like this:

access to attrs=userPassword,sambaNTPassword
 by set="this/manager & user" write
 by * break

But I realized that the ACL also allows the manager to -change- a user's password, which I don't really want.

Is there some ACL that I can grant that would let a manager remove an attribute from another user's account, but not otherwise change the value of that attribute?

Tim Gustafson
Baskin School of Engineering
UC Santa Cruz
tjg@soe.ucsc.edu
831-459-5354