Novell ACCESS MANAGER 3.1 SP2 - POLICY GUIDE 2010 Manual page 39

Unix Lines
For regular expression syntax information, see the Javadoc for java.util.regex.Pattern.
Value: Specify the second value for the comparison. If you select LDAP OU > Name of Identity
Server Configuration > User Store Name, you can browse to the name of the OU.
If you have more than 250 OUs defined in your tree, you are prompted to enter an LDAP query
string. In the text box, you need to add only the <strFilter> value for the query. For example:
<strFilter> Value
admin*
*test
*low*
For more information about the <strFilter> parameter, see RFC 2254 "LDAP Search Filter."
If you select Data Entry Field, you can specify the DN of the OU in the text field. For example:
cn=users,dc=bcf2,dc=provo,dc=novell,dc=com
ou=users,o=novell
If you have defined a Liberty User Profile or an LDAP attribute for the OU you want to match,
select this option, then select your attribute.
Result on Condition Error: Specify what the condition returns when the comparison of the two
values returns an error rather than the results of the comparison. Select either False or True. If you
do not want the action applied when an error occurs, select False. If you want the action applied
when an error occurs, select True.
LDAP Attribute Condition
The LDAP Attribute condition allows you to assign a role based on a value in an LDAP attribute
defined for the inetOrgPerson class or any other LDAP attribute you have added. You can have the
user's attribute value retrieved from your LDAP directory and compared to a value of the following
type:
Roles from an identity provider
Authenticating IDP or user store
Authentication contract, method, or type
Credential profile
LDAP attribute, OU, or group
Liberty User Profile attribute
Static value in a data entry field
To set up the matching for this condition, fill in the following fields:
Description
Returns all OUs that begin with admin, such as
adminPR, adminBG, and adminWTH.
Returns all OUs that end with test, such as doctest,
softtest, and securtest.
Returns all OUs that have "low" in the name, such
as low, yellow, and clowns.
Creating Role Policies 39