Here are improvements:

1) Instead of matching against an individual attribute, match against a set of values returned by an LDAP URI: ftp://ftp.openldap.org/incoming/manu-070918.patch

2) a man page for slapo-constraint(5) ftp://ftp.openldap.org/incoming/manu-pkg-070919.tgz