Is it possible to use dates in OpenLDAP's ACL entries? I'm looking to do something like
to * by this/termDate < NOW none by * break
I don't think it's possible within OpenLDAP.
When I've had to do something similar in the past, it was against an iPlanet/SunONE Directory Server, and we had a daily cron job that polled the payroll server for terminations, and then adjusted attributes as appropriate to lock the accounts.
The only approach I can think to try is if there's some way to get the equivalent of
NOW in an ldap filter, so you could add a 'what' clause like:
filter=( termDate < NOW )
... but I don't know of any way to do that without some sort of external intervention to set