Access Control And Replication; Logging Access Control Information - Red Hat DIRECTORY SERVER 7.1 - ADMINISTRATOR Administrator's Manual

Access Control and Replication

roledn =
"ldap:///cn=DomainAdmins,ou=Engineering,dc=HostedCompany1,
dc=example,dc=com"
The Directory Server then evaluates the ACI according to the normal ACI
evaluation algorithm.
When an attribute is multi-valued, each value is used to expand the macro, and
the first one that provides a successful match is used.
Consider this example:
dn: cn=Jane Doe,ou=People,dc=HostedCompany1,dc=example,dc=com
cn: Jane Doe
sn: Doe
ou: Engineering, dc=HostedCompany1, dc=example,dc=com
ou: People, dc=HostedCompany1,dc=example,dc=com
...
In this case, when the Directory Server evaluates the ACI, it performs a logical OR
on the following expanded expressions:
roledn =
"ldap:///cn=DomainAdmins,ou=Engineering,dc=HostedCompany1,
dc=example,dc=com"
roledn = "ldap:///cn=DomainAdmins,ou=People,dc=HostedCompany1,
dc=example,dc=com"
Access Control and Replication
ACIs are stored as attributes of entries; therefore, if an entry containing ACIs is
part of a replicated database, the ACIs are replicated like any other attribute.
ACIs are always evaluated on the Directory Server that services the incoming
LDAP requests. This means that when a consumer server receives an update
request, it will return a referral to the supplier server before evaluating whether
the request can be serviced on the supplier.

Logging Access Control Information

To obtain information on access control in the error logs, you must set the
appropriate log level.
To set the error log level from the Console:
276 Red Hat Directory Server Administrator's Guide • May 2005