Restrict LDAP bind/authenticate to a specific host

Question

I'm trying to construct an ACI for an account that will only allow that id to successfully authenticate from a given host. I'm not sure if the ACI I constructed is wrong, or if its possibly be undercut by other ACI's at the parent (or grandparent) levels. This is the ACI I created on the specific account.
(targetattr = "*")
(version 3.0;acl "allow login from host abc only";
allow (all)
(userdn = "ldap:///self")
and (ip="xxx.xxx.xxx.xxx")
and (dns="hostabc.xxx.com")
If I view the effective rights, nothing is enabled/allowed, but the account can still bind/authenticate from any workstation/server.

Answer 1

ACIs are used to restrict access to particular entries/attibues.
What you are doing is restricting access to everything based upon the IP/DNS name from which the bind takes place -- note the user is bound and trying to access something.
ACIs apply to the data, not to the bind itself.
So its normal that the users can bind from anywhere other than the IP/DNS addresses you define, they just won't be able to see anything.
I don't believe there is any way to be able to control binding itself.
On placement of ACIs:
Essentially it doesn't matter. The way ACIs work is as follows:
Tracing the path from the suffix root to the targeted enty, all ACIs on that path are collected.
They are then sorted into two "buckets", a DENY bucket for rules which deny access, and an ALLOW bucket for rules which allow access.
DENY always has precedence, so the ACIs in the DENY bucket are evaluated -- if any of them match, thats it, the request is denied -- even if an ALLOW is still sitting in the ALLOW bucket.
If we get to the end of the DENY bucket and havn't found a matching DENY rule we start processing the entries in the ALLOW bucket.
If an ALLOW rule matches, the ACI processing stops and access is allowed.
If we get to the end of the ALLOW bucket and didn't find a matching rule, there is an implicit DENY rule, and the access is denied.