Hello, everybody.

I have this structure:

dn: o=z objectclass: organization objectclass: top o: z

dn: domainName=example.org,o=z objectclass: mailDomain objectclass: top domainname: example.org

dn: uid=user,domainName=example.org,o=z objectclass: account objectclass: mailUser objectclass: top mail: user@example.org uid: user

and want to grant access only for members of subtree of every domainName:

dn: ou=Admins,domainName=example.org,o=z objectclass: organizationalUnit objectclass: top ou: Admins

dn: uid=postmaster,ou=Admins,domainName=example.org,o=z objectclass: account objectclass: mailAdmin objectclass: top mail: postmaster@example.org uid: postmaster

write ACL :

{0}to attrs=userPassword by self write by anonymous auth by * none {1}to dn.regex="^(.+,)?(domainName=[^,]+,o=z)$" by dn.onelevel,expand="ou=Admins,$2" write {2}to * by self write

and all working fine, but I want to add something this:

dn: uid=admin,domainName=example.org,o=z objectclass: account objectclass: mailAdmin objectclass: top mail: admin@example.org uid: admin

and rewrite ACL

to dn.regex="^(.+,)?(domainName=[^,]+,o=z)$" by dn.onelevel,expand="ou=Admins,$2" write

for grant write access for all subentries of domainName which has objectClass=mailAdmin .

Is it possible? How can I do it?