Map SASL principals to DNs for ACI validation

SASL authentication is not useful when using access control entries for authorization. Access control is based on a user's DN, but SASL principals/userIDs do not appear to be automatically mapped to the appropriate user's DN. For example, if I authentication using GSSAPI as the user 'aKrbUser', whose credentials are stored in entry uid=aKrbUser,dc=example,dc=com, the user should be authenticated to the directory and mapped to uid=aKrbUser,dc=example,dc=com for access control validation.

See OpenLDAP's sasl-regexp parameter in slapd.conf for reference. Example:

sasl-regexp cn=(.*),cn=example.com,cn=gssapi,cn=auth ldap:///dc=example,dc=com??sub?(uid=$1)

In OpenLDAP, the above line would search the directory context dc=example,dc=com for an entry where the uid attribute value matches the GSSAPI user ID and assign assign the entry's DN as the binddn.