Targeting Both An Entry And Attributes; Targeting Entries Or Attributes Using Ldap Filters - Netscape DIRECTORY SERVER 6.1 - ADMINISTRATOR Administrator's Manual

Creating ACIs Manually
If, however, you target the tree's branch point
ou=Marketing,dc=example,dc=com
that can contain a password attribute are affected by the ACI.

Targeting Both an Entry and Attributes

By default, the entry targeted by an ACI containing a
entry on which the ACI is placed. That is, if you put the ACI
aci: (targetattr = "uid")(access_control_rules;)
on the
entire Marketing subtree. However, you can also explicitly specify a target using
the
target
aci: (target="ldap:///ou=Marketing,
dc=example,dc=com")(targetattr="uid") (access_control_rules;)
The order in which you specify the
important.

Targeting Entries or Attributes Using LDAP Filters

You can use LDAP filters to target a group of entries that match certain criteria. To
do this, you must use the
The syntax of the
(targetfilter = "LDAP_filter")
where
syntax of LDAP search filters, see Appendix B, "Finding Directory Entries."
For example, suppose that all entries in the accounting department include the
attribute- value pair
include the attribute- value pair
in the accounting and engineering branches of the directory tree, you could use the
following filter:
(targetfilter = "(|(ou=accounting)(ou=engineering))")
This type of filter targets whole entries. You can associate the
the
targetattr
targeted entries.
The following LDIF example allows members of the Engineering Admins group to
modify the
Engineering business category. This example uses LDAP filtering to select all
entries with
204 Netscape Directory Server Administrator's Guide • August 2002
,
ou=Marketing dc=example,dc=com
keyword as follows:
targetfilter
targetfilter
is a standard LDAP search filter. For more information on the
LDAP_filter
ou=accounting
keywords to create ACIs that apply to a subset of attributes in the
departmentNumber
businessCategory
, then all the entries beneath the branch point
entry, then the ACI applies to the
and the
target targetattr
keyword with an LDAP filter.
keyword is:
, and all entries in the engineering department
subtree. To target all the entries
ou=engineering
and attributes of all entries in the
manager
attributes set to Engineering:
keyword is the
targetattr
keywords is not
targetfilter
and