Targeting Attributes - Netscape DIRECTORY SERVER 6.2 - ADMINISTRATOR Administrator's Manual

NOTE You cannot use wildcards in the suffix part of a distinguished
name. That is, if your directory uses the suffixes
then you cannot use the following target to reference both suffixes:
(target="ldap:///dc=example,c=*").
Neither can you use a target such as

Targeting Attributes

In addition to targeting directory entries, you can also target one or more attributes
included in the targeted entries. This is useful when you want to deny or allow
access to partial information about an entry. For example, you could allow access
to only the common name, surname, and telephone number attributes of a given
entry. Or you could deny access to sensitive information such as passwords.
You can specify that the target is equal or is not equal to a specific attribute. The
attributes you supply do not need to be defined in the schema. This absence of
schema checking makes it possible to implement an access control policy when you
set up your directory service for the first time, even if the ACLs you create do not
apply to the current directory content.
To target attributes, you use the
following syntax:
(targetattr = "attribute")
You can target multiple attributes by using the
following syntax:
(targetattr = "attribute1 || attribute2 ... || attributen")
Where attribute is the name of the attribute you want to target.
For example, to target the common name attribute you would use:
(targetattr = "cn")
To target an entry's common name, surname, and uid attributes, you would use
the following:
(targetattr = "cn || sn || uid")
The attributes specified in the
is targeting, and to all the entries below it. That is, if you target the password
attribute on the entry
the password attribute on the
a leaf entry.
targetattr
targetattr
uid=bjensen,ou=Marketing,dc=example,dc=com
entry is affected by the ACI because it is
bjensen
c=US
uid=bjensen,dc=*.com
keyword. The keyword uses the
keyword with the
targetattr
keyword apply to the entry that the ACI
Chapter 6 Managing Access Control
Creating ACIs Manually
and ,
c=GB
.
, only
205