How can I restrict bind operation based on attributes?

I have three applications that use my ldap installation to authenticate users with Bind operation. I need to restrict each app so it only be able to bind it's own users. my idea was to create a multi-value attribute for each user named "App" which has the name of the application that the user is allowed use (For instance: mail, portal and office). I'm looking for a way to restrict each application from binding users who do not have that application in their "App" attribute. for example portal application must only be able to bind users which have the attribute "App=portal". I was unable to do such thing using ACI. 
Is it possible to implement such restriction?

[Mailvaganam, Hari]

Perhaps via suffix?

________________________________________
From: [e-mail] [[e-mail]]
Sent: Tuesday, June 21, 2016 03:46
To: [e-mail]
Subject: [389-users] How can I restrict bind operation based on attributes?

I have three applications that use my ldap installation to authenticate users with Bind operation. I need to restrict each app so it only be able to bind it's own users. my idea was to create a multi-value attribute for each user named "App" which has the name of the application that the user is allowed use (For instance: mail, portal and office). I'm looking for a way to restrict each application from binding users who do not have that application in their "App" attribute. for example portal application must only be able to bind users which have the attribute "App=portal". I was unable to do such thing using ACI.
Is it possible to implement such restriction?
--
389-users mailing list
[e-mail]
https://lists.fedoraproject.org/admin/lists/[e-mail]...

[William Brown]

On Tue, 2016-06-21 at 10:46 +0000, [e-mail] wrote:
> I have three applications that use my ldap installation to authenticate users with Bind operation. I need to restrict each app so it only be able to bind it's own users. my idea was to create a multi-value attribute for each user named "App" which has the name of the application that the user is allowed use (For instance: mail, portal and office). I'm looking for a way to restrict each application from binding users who do not have that application in their "App" attribute. for example portal application must only be able to bind users which have the attribute "App=portal". I was unable to do such thing using ACI. 
> Is it possible to implement such restriction?

I think this is how I would do it.

Lets say we have a user:

dn: uid=test1,ou=People,dc=example,dc=com
objectClass: top
objectClass: account
objectClass: simpleSecurityObject
objectClass: YourCustomAppSchema
userPassword: password
uid: test1
application: foo

dn: uid=test2,ou=People,dc=example,dc=com
objectClass: top
objectClass: account
objectClass: simpleSecurityObject
objectClass: YourCustomAppSchema
userPassword: password
uid: test2
application: bar

Then the application foo, can have in it's user filter:

(&(uid=%s)(application=foo))

To this filter, test1 will satisfy, but test2 will not.

Conversely, test2 will work for application bar, but not foo.

Because of the way most applications work they follow this pattern:

* Anonymous bind
* User filter with username to find the DN of the object
** new bind with DN of the object if found
** fail if no DN found

As a result, this pattern will satisfy your requirements.

Check the ldapfilter configuration directive to your applications, it's
likely what you want to use.