Targeting Attribute Values Using Ldap Filters - Netscape DIRECTORY SERVER 6.1 - ADMINISTRATOR Administrator's Manual

dn: dc=example,dc=com
objectClass: top
objectClass: organization
aci: (targetattr="departmentNumber || manager")
(targetfilter="(businessCategory=Engineering)")
(version 3.0; acl "eng-admins-write"; allow (write)
groupdn ="ldap:///cn=Engineering Admins, dc=example,dc=com";)
Although using LDAP filters can be useful when you are targeting
TIP
entries and attributes that are spread across the directory, the results
are sometimes unpredictable because filters do not directly name the
object for which you are managing access. The set of entries targeted
by a filtered ACI is likely to change as attributes are added or
deleted. Therefore, if you use LDAP filters in ACIs, you should
verify that they target the correct entries and attributes by using the
same filter in an

Targeting Attribute Values Using LDAP Filters

You can use access control to target specific attribute values. This means that you
can grant or deny permissions on an attribute if that attribute's value meets the
criteria defined in the ACI. An ACI that grants or denies access based on an
attribute's value, is called a value-based ACI.
For example, you might grant all users in your organization permission to modify
the attribute in their own entry. However, you would also want to
nsRoleDN
ensure that they do not give themselves certain key roles such as "Top Level
Administrator." LDAP filters are used to check that the conditions on attribute
values are satisfied.
To create a value based ACI, you must use the
following syntax:
(targattrfilters="add=attr1:F1 && attr2:F2... && attrn:Fn,del=attr1:F1 &&
attr2:F2 ... && attrn:Fn")
where:
represents the operation of creating an attribute
add
represents the operation of deleting an attribute
del
attrx represents the target attributes
Fx represents filters that apply only to the associated attribute
operation.
ldapsearch
targattrfilters
Chapter 6
Creating ACIs Manually
keyword with the
Managing Access Control 205