Targeting Attribute Values Using Ldap Filters - Red Hat DIRECTORY SERVER 7.1 - ADMINISTRATOR Administrator's Manual

This type of filter targets whole entries. You can associate the
the keywords to create ACIs that apply to a subset of attributes in the
targetattr
targeted entries.
The following LDIF example allows members of the Engineering Admins group to
modify the
departmentNumber
Engineering business category. This example uses LDAP filtering to select all
entries with
businessCategory
dn: dc=example,dc=com
objectClass: top
objectClass: organization
aci: (targetattr="departmentNumber || manager")
(targetfilter="(businessCategory=Engineering)")
(version 3.0; acl "eng-admins-write"; allow (write)
groupdn ="ldap:///cn=Engineering Admins, dc=example,dc=com";)
TIP Although using LDAP filters can be useful when you are targeting
entries and attributes that are spread across the directory, the results
are sometimes unpredictable because filters do not directly name the
object for which you are managing access. The set of entries targeted
by a filtered ACI is likely to change as attributes are added or
deleted. Therefore, if you use LDAP filters in ACIs, you should
verify that they target the correct entries and attributes by using the
same filter in an

Targeting Attribute Values Using LDAP Filters

You can use access control to target specific attribute values. This means that you
can grant or deny permissions on an attribute if that attribute's value meets the
criteria defined in the ACI. An ACI that grants or denies access based on an
attribute's value is called a value-based ACI.
For example, you might grant all users in your organization permission to modify
the attribute in their own entry. However, you would also want to
nsRoleDN
ensure that they do not give themselves certain key roles, such as "Top Level
Administrator." LDAP filters are used to check that the conditions on attribute
values are satisfied.
To create a value-based ACI, you must use the
the following syntax:
(targattrfilters="add=attr1:F1 && attr2:F2... && attrn:Fn,del=attr1:F1
&& attr2:F2 ... && attrn:Fn")
where:
and attributes of all entries in the
manager
attributes set to Engineering:
operation.
ldapsearch
targattrfilters
Creating ACIs Manually
targetfilter
keyword with
Chapter 6 Managing Access Control
and
213