Hello and apologies if I'm posting this in the wrong location.
I'm trying to apply some security to my openldap repository and I'm struggling with how or even if I can express a particular constraint.
I have an ou containing inetOrgPerson's and the person's "o" attribute is the string value of the organisation "o" to which the user belongs, e.g. "Some Company Ltd".
e.g. dn=uid=12345679,ou=people,dc=thecompany,dc=co,dc=nz attr o=Some Company Ltd
The organisation "Some Company Ltd" can have subsidiary organisations, specified by the "owner" attribute of the subsidiary having the "dn" of owner organisation.
e.g. dn: o=Subsidiary Company Ltd,ou=organisations,dc=thecompany,dc=co,dc=nz having attr owner:o=Some Company Ltd,ou=organisations,dc=thecompany,dc=co,dc=nz
What I would like to do is restrict the user to having read access only to those subsidiary organisations based on the value of the user's "o" attribute. Is this a reasonable approach or should I be expressing this differently in my schema?
I hope I've expressed that reasonably clearly. Any help would be much appreciated.