Targeting Attribute Values Using Ldap Filters - Netscape DIRECTORY SERVER 6.01 - ADMINISTRATOR Administrator's Manual

Creating ACIs Manually
where
syntax of LDAP search filters, see Appendix B, "Finding Directory Entries."
For example, suppose that all entries in the accounting department include the
attribute- value pair
include the attribute- value pair
in the accounting and engineering branches of the directory tree, you could use the
following filter:
(targetfilter = "(|(ou=accounting)(ou=engineering))")
This type of filter targets whole entries. You can associate the
the
targetattr
targeted entries.
The following LDIF example allows members of the Engineering Admins group to
modify the
Engineering business category. This example uses LDAP filtering to select all
entries with
dn: dc=example,dc=com
objectClass: top
objectClass: organization
aci: (targetattr="departmentNumber || manager")
(targetfilter="(businessCategory=Engineering)")
(version 3.0; acl "eng-admins-write"; allow (write)
groupdn ="ldap:///cn=Engineering Admins, dc=example,dc=com";)
TIP

Targeting Attribute Values Using LDAP Filters

You can use access control to target specific attribute values. This means that you
can grant or deny permissions on an attribute if that attribute's value meets the
criteria defined in the ACI. An ACI that grants or denies access based on an
attribute's value, is called a value-based ACI.
198 Netscape Directory Server Administrator's Guide • January 2002
is a standard LDAP search filter. For more information on the
LDAP_filter
ou=accounting
keywords to create ACIs that apply to a subset of attributes in the
departmentNumber
businessCategory
Although using LDAP filters can be useful when you are targeting
entries and attributes that are spread across the directory, the results
are sometimes unpredictable because filters do not directly name the
object for which you are managing access. The set of entries targeted
by a filtered ACI is likely to change as attributes are added or
deleted. Therefore, if you use LDAP filters in ACIs, you should
verify that they target the correct entries and attributes by using the
same filter in an
, and all entries in the engineering department
ou=engineering
and attributes of all entries in the
manager
attributes set to Engineering:
operation.
ldapsearch
subtree. To target all the entries
targetfilter
and