Pls help: aci based on reference to other entries?

Question

Hello,
We've question in defining ACI. Our users are students, who can enroll multiple study programmes. Thus our entries (simplified version) looks like following:
For student:
dn: uid=1234,dc=my,dc=domain
objectclass: inetorgperson
objectclass: student
cn: my CN
sn: my SN
studentID: A1234
userpasswd: ....
For the study programmes of corresponding student ('links" to student records through studentID attribute):
dn: uid=7890,dc=my,dc=domain
objectclass: studentprofile
programmeName: Dept of Chemistry
studentID: A1234
dn: uid=8901,dc=my,dc=domain
objectclass: studentprofile
programmeName: Dept of Physics
studentID: A1234
Now we want to define an ACI to limit access to student records based on the study programme (programmeName in above example). However, since the programmeName doesn't exist in the student's record, I wonder if it's possible to setup such ACI.
Would anyone please help?
Thanks a lot.
/ST Wong

Answer 1

Hello,
perhaps you could base your ACIs on DS Groups.
Your study programmes definitions are essentially, or could be defined as, Groups. Each Student can be a Member of some DS Groups.
IDM Ldap connector supports group memberships.
Then you can write ACIs which refer, in the Bind Rule part, the groups.
Using groups can leverage:
- referential integrity (when you remove a student from DS it is automacally removed from his/her groups)
- class of service (attributes are automatically assigned to students depending their memberships)
HTH