I modified my patch to slapo-constaint. The constraint can now be written as a
LDAP url, which allows much more flexibility:
Here is the new patch:
Comments are welcome. I'll now write a man page.