Netscape DIRECTORY SERVER 6.02 - ADMINISTRATOR Administrator's Manual page 216

Bind Rules
NOTE
The DN of the role can be under any suffix in the database. If, in addition, you are
using filtered roles, the evaluation of this type of ACI uses a lot of resources on the
server.
If you are using a static role definition, and the role entry is under the same suffix
as the targeted entry, you can use the following expression:
userattr = "ldap:///dc=example,dc=com?employeeReportsTo#ROLEDN"
In this example, the role entry is under the
can process this type of syntax more quickly than the previous example.
Example With LDAPURL Bind Type
The following is an example of the
based on an LDAP filter:
userattr = "myfilter#LDAPURL"
The bind rule is evaluated to be true if the bind DN matches the filter specified in
the myfilter attribute of the targeted entry. The myfilter attribute can be replaced by
any attribute that contains an LDAP filter.
Example With Any Attribute Value
The following is an example of the
based on any attribute value:
userattr = "favoriteDrink#Beer"
The bind rule is evaluated to be true if the bind DN and the target DN include the
favoriteDrink
216 Netscape Directory Server Administrator's Guide • May 2002
This example assumes that you have added the
exampleEmployeeReportsTo
employee entries contain this attribute. It also assumes that the
value of this attribute is the DN of a role entry.
For information on designing your schema, refer to Netscape
Directory Server Deployment Guide. For information on adding
attributes to the schema, see "Creating Attributes," on page 333.
attribute with a value of
attribute to the schema, and that all
dc=example,dc=com
keyword associated with a bind
userattr
keyword associated with a bind
userattr
.
Beer
suffix. The server