Netscape NETSCAPE DIRECTORY SERVER 6.02, Administrator'S Manual

Page: 255 / 568

Advanced Access Control: Using Macro ACIs
Chapter 6 Managing Access Control 255
3.
Replace [$dn] in subject with
dc=hostedCompany1
.
The result is
groupdn="ldap:///cn=DomainAdmins,ou=Groups,
dc=hostedCompany1,dc=example,dc=com"
. In this case, if the bind DN is not
a member of that group, the ACI is not evaluated. If it is a member, the ACI is
evaluated.
The advantage of the [$dn] macro is that it provides a flexible way of granting
access to domain-level administrators to all the subdomains in the directory tree.
Therefore, it is useful for expressing a hierarchical relationship between domains.
For example, consider the following ACI:
aci: (target="ldap:///ou=*, ($dn),dc=example,dc=com")
(targetattr="*")(targetfilter=(objectClass=nsManagedDomain))
(version 3.0; acl "Domain access"; allow (read,search)
groupdn="ldap:///cn=DomainAdmins,ou=Groups,[$dn],dc=example,dc=com"
;)
It grants access to the members of
cn=DomainAdmins,ou=Groups,
dc=hostedCompany1,dc=example,dc=com
to all of the subdomains under
dc=hostedCompany1
, so an administrator belonging to that group could access, for
example, the subtree
ou=people, dc=subdomain1.1, dc=subdomain1
.
However, at the same time, members of
cn=DomainAdmins,ou=Groups,
dc=subdomain1.1
, would be denied access to the
ou=people,dc=hostedCompany1
and
ou=people,dc=hostedCompany1
nodes.
Macro Matching for ($attr.
attrName
)
The ($attr.attrname) macro is always used in the subject part of a DN. For example,
you could define the following
roledn
:
roledn = "ldap:///cn=DomainAdmins,($attr.ou)"
Now, assume the server receives an LDAP operation targeted at the following
entry:
dn: cn=Jane Doe, ou=People, dc=HostedCompany1, dc=example,dc=com
cn: Jane Doe
sn: Doe
ou: Engineering, dc=HostedCompany1, dc=example,dc=com
...