in the <what> clause of ACLs, only 'attr=' or 'attrs=' are allowed; the former for backwards compatibility, while slapd.access(5) correctly uses only the latter form

a mod operation

Move ldapi into $(RUNDIR)/run/openldap

Needs identity mapping and proxy authorization support

it's value as a unique key.

note that other controls may need different access
privileges via, e.g., backend_attribute() (syncrepl?)