Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 206 / 578

Creating ACIs Manually
206 Netscape Directory Server Administrator’s Guide • August 2002
When creating an entry, if a filter applies to an attribute in the new entry, then each
instance of that attribute must satisfy the filter. When deleting an entry, if a filter
applies to an attribute in the entry, then each instance of that attribute must also
satisfy the filter.
When modifying an entry, if the operation adds an attribute, then the add filter that
applies to that attribute must be satisfied; if the operation deletes an attribute, then
the delete filter that applies to that attribute must be satisfied. If individual values
of an attribute already present in the entry are replaced, then both the add and
delete filters must be satisfied.
For example consider the following attribute filter:
(targattrfilters=”add=nsroleDN:(!(nsRoleDN=cn=superAdmin)) &&
telephoneNumber:(telephoneNumber=123*))
This filter can be used to allow users to add any role (
nsRoleDN
attribute) to their
own entry, except the
superAdmin
role. It also allows users to add a telephone
number with a 123 prefix.
Targeting a Single Directory Entry
Targeting a single directory entry is not straightforward because it goes against the
design philosophy of the access control mechanism. However, it can be done:
• By creating a bind rule that matches user input in the bind request with an
attribute value stored in the targeted entry. For more details, see “Defining
Access Based on Value Matching,” on page 218.
• By using the
targetattr
and
targetfilter
keywords
You can use the
targetattr
keyword to specify an attribute that is only present in
the entry you want to target, and not in any of the entries below your target. For
example, if you want to target
ou=people,dc=example,dc=com
, and there aren’t
any organizational units (
ou
) defined below that node you could specify an ACI
that contains:
targetattr=ou
A safer method is to use the
targetfilter
keyword and to explicitly specify an
attribute value that appears in the entry alone. For example, during the installation
of the Directory Server, the following ACI is created:
NOTE You cannot create value-based ACIs from the Server Console.