Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 200 / 578

Creating ACIs Manually
200 Netscape Directory Server Administrator’s Guide • August 2002
where:
❍
keyword
indicates the type of target
❍
equal (=) indicates that the target is the object specified in the
expression
, and
not equal (!=) indicates the target is not the object specified in the
expression
.
❍
expression
identifies the target
The quotation marks ("") around
expression
are required. What you use for
expression
is dependent upon the
keyword
that you supply.
The following table lists each keyword and the associated expressions:
In all cases, you must keep in mind that when you place an ACI on an entry, if it is
not a leaf entry, the ACI also applies to all entries below it. For example, if you
target the entry
ou=accounting,dc=example,dc=com
, the permissions you set will
apply to all entries in the accounting branch of the
example.com
tree.
As a counter example, if you place an ACI on the
ou=accounting,dc=example,dc=com
entry, you cannot target the
uid=sarette,ou=people,dc=example,dc=com
entry because it is not located
under the accounting tree.
Be wary of using
!=
when specifying an attribute you want to deny. ACLs are
logically ORed, which means that if you created two ACLs
acl1: ( target=...)( targetattr!=a )(version 3.0; acl "name";allow
(...)..
acl2: ( target=...)( targetattr!=b )(version 3.0; acl "name";allow
(...)..
Table 6-1
LDIF Target Keywords
Keyword Valid Expressions Wildcard
Allowed?
target
ldap:///distinguished_name yes
targetattr
attribute yes
targetfilter
LDAP_filter yes
targattrfilters
LDAP_operation:LDAP_filter yes