Dates in openldap acl rules
I don't think it's possible within OpenLDAP.

When I've had to do something similar in the past, it was against an iPlanet/SunONE Directory Server, and we had a daily cron job that polled the payroll server for terminations, and then adjusted attributes as appropriate to lock the accounts.

The only approach I can think to try is if there's some way to get the equivalent of NOW in an ldap filter, so you could add a 'what' clause like:

filter=( termDate &lt; NOW )


... but I don't know of any way to do that without some sort of external intervention to set NOW.