I'm trying to write an access control for OpenLDAP to allow a user to search with a certain base dn, but only get results back from certain sub dn's. I've played with lots of different rules but cant get it to work. I'm not sure its even possible.
I have the user with the dn
uid=testuser,ou=people,dc=example,dc=com. I want this user to be able to search with a base of
dc=example,dc=com and get back entries in
ou=people,dc=example,dc=com. There are lots of other sub OUs under
dc=example,dc=com, but only entries in
ou=people should be returned (for bonus, I'd only like certain attributes to be returned as well).
Can this be done?