Dynamic access control in openldap ldap - openldap

Question

dI am trying to use openldap as a central authentication system as well as storing some data based on the user type.
My ldap DIT structure is as follows
domain
Superuser Users data
User1 user2 user3 Entry1 Entry2
With every user entry I have fixed auth string,.. example-
for user1
authstring=Entry1-RW #allowing entry1 to be readable and writable
authstring=Entry2.R #allowing entry2 to be readable
and similarly for user2
authstring=*.RW #allowing all entries to be readable and writable
How can I define my slapd.conf without hardcoding all the cases to achieve this functionality?
Usually we can only define the the access control with dn.
can I restrict the access control definitions using attrs?
like
access to dn.regex=uid=[^,]ou=data,dc=my-domain,dc=com
by dn="uid=.*,ou=users,dc=my-domain,dc=com" filter=authstring=$1.RW

Answer 1

I could do the following:(uid is the attribute of data entry it could be cn also)
access to dn.regex="uid=[^,]+,ou=data,dc=my-domain,dc=com"
by set.expand="this/uid & user/authstring" write
But still the problem is that I have to write separate attr for each dataEntry and each type of permission
Example:
For user1:
authstringread:Entry1
authstringreadwrite:Entry2
and the access control settings would be
access to dn.regex=uid=[^,],ou=data,dc=my-domain,dc=com
by set.expand="this/uid & user/authstringreadwrite" write
by set.expand="this/uid & user/authstringread" read

Answer 2

You can certainly restrict the ACL methods using attrs either way :
For user1 :
aci: (targetattr=*)(targetfilter="(entryCategory=Entry1)")(version 3.0; acl "read-write"; allow (read, write)userdn ="ldap:///uid=user1,dc=example,dc=com";)
aci: (targetattr=*)(targetfilter="(entryCategory=Entry2)")(version 3.0; acl "read"; allow (read)userdn ="ldap:///uid=user1,dc=example,dc=com";)
For user2 :
aci: (targetattr=*)(targetfilter="(|(entryCategory=Entry1)(entryCategory=Entry2)")(version 3.0; acl "read-write"; allow (write)userdn ="ldap:///uid=user2, dc=example,dc=com";)
Similarly, you can allow anyone to have specific read or write access.
aci: (version 3.0; acl "anonymous-read-search";allow (read, write) userdn = "ldap:///anyone";)
or
For specific user set :
userdn = "ldap:///uid=b*,c=example.com ||ldap:///cn=b*,dc=example,dc=com";
Checkout this link for more readings :
http://docs.oracle.com/cd/E22289_01/html/821-1277/bind-rule-syntax.html#defining-anonymous-access-anyone-keyword
Hope this helps.
Thanks, John