Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 220 / 578

Bind Rules
220 Netscape Directory Server Administrator’s Guide • August 2002
If you are using static groups that are under the same suffix as the targeted entry,
you can use the following expression:
userattr = "ldap:///dc=example,dc=com?owner#GROUPDN"
In this example, the group entry is under the
dc=example,dc=com
suffix. The
server can process this type of syntax more quickly than the previous example.
(By default,
owner
is not an allowed entry in a user’s entry. You would have to
extend your schema to allow this attribute in a
person
object.)
Example With ROLEDN Bind Type
The following is an example of the
userattr
keyword associated with a bind
based on a role DN:
userattr = "exampleEmployeeReportsTo#ROLEDN"
The bind rule is evaluated to be true if the bind DN belongs to the role specified in
the
exampleEmployeeReportsTo
attribute of the targeted entry. For example, if
you create a nested role for all managers in your company, you can use this
mechanism to grant managers at all levels access to information about employees
that are at a lower grade than themselves.
The DN of the role can be under any suffix in the database. If, in addition, you are
using filtered roles, the evaluation of this type of ACI uses a lot of resources on the
server.
If you are using a static role definition, and the role entry is under the same suffix
as the targeted entry, you can use the following expression:
userattr = "ldap:///dc=example,dc=com?employeeReportsTo#ROLEDN"
In this example, the role entry is under the
dc=example,dc=com
suffix. The server
can process this type of syntax more quickly than the previous example.
NOTE This example assumes that you have added the
exampleEmployeeReportsTo
attribute to the schema, and that all
employee entries contain this attribute. It also assumes that the
value of this attribute is the DN of a role entry.
For information on designing your schema, refer to Netscape
Directory Server Deployment Guide. For information on adding
attributes to the schema, see “Creating Attributes,” on page 339.