aci:(targetattr = "*")(target = "ldap:///ou=Restricted,o=tupperware,c=US")(version 3.0; acl "Restricted Read Access"; allow (read,search,compare) (userdn = "ldap:///uid=someone,ou=users,o=tupperware,c=US") and (ip="192.168.1.*" or ip="10.2.3.4" or ip="10.2.3.5" or ip="10.2.3.6") ;)
It doesn't really prevent the uid=someone from logging in but the user won't be able to read any attributes from the target tree unless accessing from those IP addresses.
Maybe not really what you are after but just a suggestion.
Cheers,
Bazza
On 08/07/2010, at 5:48 AM, Fairchild, Anthony wrote: