RE: restricting acls more by adding a filter

[Marc]

> 
> > I have a ldapsearch that returns this object
> >
> > sendmailMTAClassName: w
> > sendmailMTAClassValue: xxx
> > sendmailMTAClassValue: yyy
> > sendmailMTAClassValue: zzz
> > objectClass: sendmailMTA
> > objectClass: sendmailMTAClass
> >
> > I thought I could strengthen the acl by just appending to with a
> filter
> >
> > but if I add these below, the ldapsearch does not return anything
> err=32
> >
> > filter=(objectClass=sendmailMTAClass)
> > filter=(|(objectClass=sendmailMTAClass)(objectClass=sendmailMTA))
> > filter=(|(objectClass=sendmailMTAClass)(objectClass=sendmailMTA))
> > filter=(objectClass=sendmailMTA*)
> 
> 
> a) ACLs are contextual

I am just appending this to an existing 'standard' type of acl

to dn.subtree="dc=local" 
filter=(|(objectClass=sendmailMTAClass)(objectClass=sendmailMTA))
  by ssf=64 dn.exact="cn=cron,dc=local" read