Is it possible to use dates in OpenLDAP's ACL entries? I'm looking to do something like to * by this/termDate < NOW none by * break

  • not exactly a dba question if you ask me. Maybe this <serverfault.com/questions/tagged/ldap> is a better place to look?
    – ik_zelf
    Mar 7, 2011 at 21:07
  • 1
    meta thought it was on topic, so here it is
    – Brad Mace
    Mar 7, 2011 at 22:30
  • @ik_zelf : and this is exactly why a few of us complained about the name change.
    – Joe
    Mar 7, 2011 at 23:15
  • so if I'm reading this correctly -- you're trying to set a termination date for the user, after which they no longer have access to do something?
    – Joe
    Mar 7, 2011 at 23:22
  • @Joe - yeah that's the idea
    – Brad Mace
    Mar 8, 2011 at 1:29

1 Answer 1


I don't think it's possible within OpenLDAP.

When I've had to do something similar in the past, it was against an iPlanet/SunONE Directory Server, and we had a daily cron job that polled the payroll server for terminations, and then adjusted attributes as appropriate to lock the accounts.

The only approach I can think to try is if there's some way to get the equivalent of NOW in an ldap filter, so you could add a 'what' clause like:

filter=( termDate < NOW )

... but I don't know of any way to do that without some sort of external intervention to set NOW.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.