Netscape NETSCAPE DIRECTORY SERVER 6.02, Administrator'S Manual

Page: 205 / 568

Creating ACIs Manually
Chapter 6 Managing Access Control 205
Comparing the value of an attribute:
• Grant compare permission on the attribute type.
Searching for entries:
• Grant search permission on each attribute type used in the search filter.
• Grant read permission on attribute types used in the entry.
The permissions you need to set up to allow users to search the directory are more
readily understood with an example. Consider the following
ldapsearch
operation:
% ldapsearch -h
host
-s
base
-b
"
uid=bkolics,dc=example,dc=com
"
objectclass=* mail
The following ACI is used to determine whether user
bkolics
can be granted
access:
aci: (targetattr = "mail")(version 3.0; acl "self access to mail";
allow (read, search) userdn = "ldap:///self";)
The search result list is empty, because this ACI does not grant access to the
objectclass attribute. If you want the search operation described above to be
successful, you must modify the ACI to read as follows:
aci: (targetattr = "mail || objectclass")(version 3.0; acl "self
access to mail"; allow (read, search) userdn = "ldap:///self";)
Permissions Syntax
In an ACI statement, the syntax for permissions is:
allow|deny (
rights
)
where
rights
is a list of 1 to 8 comma-separated keywords enclosed within
parentheses. Valid keywords are
read
,
write
,
add
,
delete
,
search
,
compare
,
selfwrite
,
proxy
, or
all
.
In the following example, read, search, and compare access is allowed, provided
the bind rule is evaluated to be true:
aci: (target="ldap:///dc=example,dc=com") (version 3.0;acl
"example";
allow (read, search, compare)
bind_rule
;)