Defining Targets - Red Hat DIRECTORY SERVER 8.0 - ADMINISTRATION Administration Manual

The following is an example of a complete LDIF ACI:
aci: (target="ldap:///uid=bjensen,dc=example,dc=com")(targetattr=*)
(version 3.0;acl "aci1";allow (write) userdn="ldap:///self";)
In this example, the ACI states that the user bjensen has rights to modify all attributes in her own
directory entry.

6.3.2. Defining Targets

The target identifies to what the ACI applies. If the target is not specified, the ACI applies to the entry
containing the aci attribute and to the entries below it. A target can be any of the following:
• A directory entry or all of the entries in a subtree, as described in
Directory Entry".
• Attributes of an entry, as described in
• A set of entries or attributes that match a specified LDAP filter, as described in
"Targeting Entries or Attributes Using LDAP
• An attribute value, or a combination of values, that match a specified LDAP filter, as described in
Section 6.3.2.5, "Targeting Attribute Values Using LDAP
The general syntax for a target is as follows:
(keyword = "expression")
(keyword != "expression")
• keyword indicates the type of target.
• equal (=) indicates that the target is the object specified in the expression, and not equal (!=)
indicates the target is not the object specified in the expression.
• expression identifies the target.
The quotation marks ("") around expression are required. What you use for expression is dependent
upon the keyword that you supply.
Table 6.1, "LDIF Target Keywords"
Keyword
target
targetattr
targetfilter
targetattrfilters
Table 6.1. LDIF Target Keywords
In all cases, you must keep in mind that when you place an ACI on an entry, if it is not a
leaf entry, the ACI also applies to all entries below it. For example, if you target the entry
Section 6.3.2.2, "Targeting
Filters".
lists each keyword and the associated expressions.
Valid Expressions
ldap:///distinguished_name
attribute
LDAP_filter
LDAP_operation:LDAP_filter
Section 6.3.2.1, "Targeting a
Attributes".
Section 6.3.2.4,
Filters".
Wildcard Allowed
Yes
Yes
Yes
Yes
Defining Targets
147