The groupdn keyword specifies that access to a targeted entry is granted or denied if the user binds by using a DN that belongs to a specific group. The groupdn keyword uses this syntax:
groupdn="ldap:///groupDN [|| ldap:///groupDN]..."
The bind rule is evaluated to be true if the bind DN belongs to a group that is specified by any of the values for groupDN.
In the following example, the bind rule is true if the bind DN belongs to the Administrators group :
aci: (version 3.0; acl "Administrators-write"; allow (write) groupdn="ldap:///cn=Administrators,dc=example,dc=com";)
Characters that are syntactically significant for a DN, such as commas, must be escaped with a single backslash (\).