Currently, overlays, SLAPI and DynACL are the mechanisms supported by slapd that allow to write custom code to check access. Their features are much different, and the choice of the "best" solution may not be trivial.

Overlays (and SLAPI, which is currently wrapped into an overlay), are designed to allow the insertion of custom code within the execution of regular operations. Among the other phases of operation handling, they provide a sort of a replacement of the frontend access control capabilities, with the possibility to fall thru to conventional access control as a last resort.

DynACL, instead, is expressely designed as an access control layer; it provides granular access control capabilities cast into the conventional frontend access control.