Defining Access Based On Value Matching; Using The Userattr Keyword - Netscape DIRECTORY SERVER 6.01 - ADMINISTRATOR Administrator's Manual

roledn = "ldap:///dn [|| ldap:///dn]... [|| ldap:///dn]"
The bind rule is evaluated to be true if the bind DN belongs to the specified role.
If a DN contains a comma, the comma must be escaped by a
NOTE
backslash (\).
The keyword has the same syntax and is used in the same way as the
roledn
keyword.
groupdn

Defining Access Based on Value Matching

You can set bind rules to specify that an attribute value of the entry used to bind to
the directory must match an attribute value of the targeted entry.
For example, you can specify that the bind DN must match the DN in the
attribute of a user entry in order for the ACI to apply. In this case, only the user's
manager would have access to the entry.
This example is based on DN matching. However, you can match any attribute of
the entry used in the bind with the targeted entry. For example, you could create an
ACI that allowed any user whose
entries of other users that have the same value for

Using the userattr Keyword

The keyword can be used to specify which attribute values must match
userattr
between the entry used to bind and the targeted entry. You can specify:
• A user DN
• A group DN
• A role DN
• An LDAP filter, in an LDAP URL
• Any attribute type
The LDIF syntax of the
userattr = "attrName#bindType"
or, if you are using an attribute type that requires a value other than a user DN,
group DN, role DN, or an LDAP filter:
favoriteDrink
keyword is as follows:
userattr
attribute is "beer" to read all the
.
favoriteDrink
Chapter 6 Managing Access Control
Bind Rules
manager
211