Emmanuel Dreyfus manu@netbsd.org wrote:
If it is not, is there a way to give the addition right without giving the delete right?
Following up myself:
Yes, it seems possible, according to the documentation in order to add, one need write access to - attrs=childrens of the parent
in order to delete, one need write access to - attrs=childrens of the parent - attrs=entry of the entry to be deleted
So it seems possible to do what I'm looking for, by using two ACL. Does something like this look reasonable?
access to dn.regex="(ou=.+,o=home)$" attrs=children by group/netExampleService/manager.expand="$1" write stop by * read stop
access to filter="(!(locked=TRUE))" attrs=entry by group/netExampleService/manager write stop by * read stop