Macro Matching For ($Attr.attrname) - Netscape DIRECTORY SERVER 6.01 - ADMINISTRATOR Administrator's Manual

Replace [$dn] in subject with
3.
The result is
groupdn="ldap:///cn=DomainAdmins,ou=Groups,
dc=hostedCompany1,dc=example,dc=com"
a member of that group, the ACI is not evaluated. If it is a member, the ACI is
evaluated.
The advantage of the [$dn] macro is that it provides a flexible way of granting
access to domain-level administrators to all the subdomains in the directory tree.
Therefore, it is useful for expressing a hierarchical relationship between domains.
For example, consider the following ACI:
aci: (target="ldap:///ou=*, ($dn),dc=example,dc=com")
(targetattr="*")(targetfilter=(objectClass=nsManagedDomain))
(version 3.0; acl "Domain access"; allow (read,search)
groupdn="ldap:///cn=DomainAdmins,ou=Groups,[$dn],dc=example,dc=com"
;)
It grants access to the members of
dc=hostedCompany1,dc=example,dc=com
dc=hostedCompany1
example, the subtree
However, at the same time, members of
, would be denied access to the
dc=subdomain1.1
and
ou=people,dc=hostedCompany1

Macro Matching for ($attr.attrName)

The ($attr.attrname) macro is always used in the subject part of a DN. For example,
you could define the following
roledn = "ldap:///cn=DomainAdmins,($attr.ou)"
Now, assume the server receives an LDAP operation targeted at the following
entry:
dn: cn=Jane Doe, ou=People, dc=HostedCompany1, dc=example,dc=com
cn: Jane Doe
sn: Doe
ou: Engineering, dc=HostedCompany1, dc=example,dc=com
...
dc=hostedCompany1
cn=DomainAdmins,ou=Groups,
, so an administrator belonging to that group could access, for
ou=people, dc=subdomain1.1, dc=subdomain1
cn=DomainAdmins,ou=Groups,
nodes.
:
roledn
Advanced Access Control: Using Macro ACIs
.
. In this case, if the bind DN is not
to all of the subdomains under
ou=people,dc=hostedCompany1
Chapter 6 Managing Access Control
.
253