Netscape NETSCAPE DIRECTORY SERVER 6.02, Administrator'S Manual

Page: 253 / 568

Advanced Access Control: Using Macro ACIs
Chapter 6 Managing Access Control 253
• [$dn]
• ($attr.attrName), where attrName represents an attribute contained in the target
entry
To simplify the discussion in this section, the ACI keywords used to provide bind
credentials such as
userdn
,
roledn
,
groupdn
, and
userattr
, are collectively called
the subject, as opposed to the target of the ACI. Macro ACIs can be used in the
target part or the subject part of an ACI.
Table 6-3 shows in what parts of the ACI you can use DN macros:
The following restrictions apply:
• If you use ($dn) in
targetfilter
,
userdn
,
roledn
,
groupdn
,
userattr
, you
must define a target that contains ($dn).
• If you use [$dn] in
targetfilter
,
userdn
,
roledn
,
groupdn
,
userattr
, you
must define a target that contains ($dn).
In short, you when using any macro, you always need a target definition that
contains the ($dn) macro.
You can combine the ($dn) macro and the ($attr.attrName) macro.
Macro Matching for ($dn)
The ($dn) macro is replaced by the matching part of the resource targeted in an
LDAP request. For example, you have an LDAP request targeted at the
cn=all,
ou=groups,dc=subdomain1,dc=hostedCompany1,dc=example,dc=com
entry, and
an ACI that defines the target as follows:
(target="ldap:///ou=Groups,($dn),dc=example,dc=com")
The ($dn) macro matches with "
dc=subdomain1, dc=hostedCompany1
".
When the subject of the ACI also uses ($dn), the substring that matches the target is
used to expand the subject. For example:
Table 6-3 Macros in ACI Keywords
Macro ACI Keyword
($dn) target, targetfilter, userdn, roledn,groupdn, userattr
[$dn] targetfilter, userdn, roledn, groupdn, userattr
($attr.attrName) userdn, roledn, groupdn, userattr