I want to write an ldif file that will modify or replace an ACI, but the object in question has seven ACIs. How do I tell it which one? If you have "replace: aci", can you add some kind of WHERE clause or regexp or ???

I am not an LDAP user and had to look up ldif and using ldif to modify ACIs... so what I know on the subject I learned today!

That said, as no one else has stepped in, so perhaps I can point you to some helpful resources.

This CentOS page, Creating ACIs Manually includes a link to this page, LDIF Update Statements. Between them they appear to cover the available commands and syntax relevant to your question.

As you know what you are looking for better than anyone else I would suggest using your search engine of choice to find available online resources. Then if you have trouble making it work, return and tell us what you have found, tried and been unable to get to work.

Good luck!