baby steps: allow secretary to create people in LDAP
baby steps: allow secretary to create people in LDAP

See: http://www.openldap.org/doc/admin24/access-control.html#What%20to%20control%20access%20to

"There are two special pseudo attributes entry and children. To read (and hence
return) a target entry, the subject must have read access to the target's entry
attribute. To perform a search, the subject must have search access to the
search base's entry attribute. To add or delete an entry, the subject must have
write access to the entry's entry attribute AND must have write access to the
entry's parent's children attribute. To rename an entry, the subject must have
write access to entry's entry attribute AND have write access to both the old
parent's and new parent's children attributes."

So note that this will grant the secretary access to delete an entry.  There is
no intent to make use of this other than for test purposes (creating and
deleting test people).  In particular, there is no intent to create higher
level whimsy tooling to delete people, as the common practice is to disable
people instead.

apache/infrastructure-puppet,apache/infrastructure-puppet,sebbASF/infrastructure-puppet,apache/infrastructure-puppet,apache/infrastructure-puppet,sebbASF/infrastructure-puppet,apache/infrastructure-puppet,sebbASF/infrastructure-puppet,sebbASF/infrastructure-puppet,sebbASF/infrastructure-puppet,sebbASF/infrastructure-puppet,apache/infrastructure-puppet,sebbASF/infrastructure-puppet,apache/infrastructure-puppet,sebbASF/infrastructure-puppet