Is it possible to use dates in OpenLDAP's ACL entries? I'm looking to do something like to * by this/termDate < NOW none by * break

  • not exactly a dba question if you ask me. Maybe this <serverfault.com/questions/tagged/ldap> is a better place to look?
    – user953
    Mar 7, 2011 at 21:07
  • 1
    meta thought it was on topic, so here it is
    – Brad Mace
    Mar 7, 2011 at 22:30
  • @ik_zelf : and this is exactly why a few of us complained about the name change.
    – Joe
    Mar 7, 2011 at 23:15
  • so if I'm reading this correctly -- you're trying to set a termination date for the user, after which they no longer have access to do something?
    – Joe
    Mar 7, 2011 at 23:22
  • @Joe - yeah that's the idea
    – Brad Mace
    Mar 8, 2011 at 1:29

1 Answer 1


I don't think it's possible within OpenLDAP.

When I've had to do something similar in the past, it was against an iPlanet/SunONE Directory Server, and we had a daily cron job that polled the payroll server for terminations, and then adjusted attributes as appropriate to lock the accounts.

The only approach I can think to try is if there's some way to get the equivalent of NOW in an ldap filter, so you could add a 'what' clause like:

filter=( termDate < NOW )

... but I don't know of any way to do that without some sort of external intervention to set NOW.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .