I wonder if there is an ACI statement that allows to filter the response on attribute values. OpenLDAP has something called ACI value selector (for example "attrs=memberof val.childern='ou=Dummy,dc=test,dc=org'" that will only return attribute values for 'memberof' having a value being part of the subtree 'ou=Dummy,dc=test,dc=org' and filter away other memberof values). There is an 'targattrfiltes' statement in 389 DS, but that only applies on 'add' or 'delete' operations (would like to have one for 'read')