Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 213 / 578

Bind Rules
Chapter 6 Managing Access Control 213
Defining User Access - userdn Keyword
User access is defined using the
userdn
keyword. The
userdn
keyword requires
one or more valid distinguished names in the following format :
userdn = "ldap:///
dn
[|| ldap:///
dn
]...[||ldap:///
dn
]"
where
dn
can be a DN or one of the expressions
anyone
,
all
,
self
, or
parent
:
userdn = "ldap:///anyone
" - defines anonymous access
userdn = "ldap:///all
" - defines general access
userdn =
"
ldap:///self
" - defines self access
userdn =
"
ldap:///parent
" - defines access for the parent entry
The
userdn
keyword can also be expressed as an LDAP filter of the form:
ldap:///
suffix
??sub?(
filter
)
Anonymous Access (anyone Keyword)
Granting anonymous access to the directory means that anyone can access it
without providing a bind DN or password, and regardless of the circumstances of
the bind. You can limit anonymous access to specific types of access (for example,
access for read or access for search) or to specific subtrees or individual entries
within the directory.
From the Server Console, you define anonymous access through the Access
Control Editor. See “Creating ACIs From the Console,” on page 229.
General Access (all Keyword)
You can use bind rules to indicate that a permission applies to anyone who has
successfully bound to the directory; that is, all authenticated users. This allows
general access while preventing anonymous access.
From the Server Console, you define general access on the Access Control Editor.
For more information, see “Creating ACIs From the Console,” on page 229.
NOTE If a DN contains a comma, the comma must be preceded by a
backslash (\) escape character.