The userdn keyword can also be expressed as an LDAP URL with a filter, by using this syntax:
userdn = ldap:///suffix??sub?(filter)
LDAP URLs always apply to the local server. Do not specify a hostname or port number within an LDAP URL.
The following ACI on the dc=example,dc=com node allows all users in the accounting and engineering branches of the example.com tree to access to the targeted resource dynamically based on the following URL
userdn = "ldap:///dc=example,dc=com??sub?(|(ou=eng)(ou=acct))"
LDAP URLs can be used with the logical OR operator and the not-equal operator as shown in the following examples.
This bind rule is evaluated to be true for users that bind with either of the specified DN patterns.
userdn = "ldap:///uid=b*,c=example.com || ldap:///cn=b*,dc=example,dc=com";
This bind rule is evaluated to be true if the client is not binding as a UID-based DN in the accounting subtree. This bind rule only makes sense if the targeted entry is not under the accounting branch of the directory tree.
userdn != "ldap:///uid=*,ou=Accounting,dc=example,dc=com";