Is possible to limit the visibility of a standard LDAP user?
I'd like standard users are allowed to read only their personal information, and deny them to read someone else profile.
I tried to apply a deny permission on the OU(organizational unit) but there are some default grant permission on the user object and since they are in a closer level, they can override the deny setting.
by default "authenticated users" can read on an user object:
remove user by user these "authenticated users" permissions,
add user by user "self" read permissions
deny users read on the OU's sub-objects
but is quite painful and I'm not sure if it can cause malfunctions.
someone have some advise? Is there an easier approach?