Red Hat DIRECTORY SERVER 8.0, Administration Manual

Page: 179 / 552

Defining Role Access - roledn Keyword
161
Scenario Example Description
directory tree, you would create the following ACI on the
dc=example,dc=com
node:
aci: (version 3.0; acl "Administrators-write"; allow (write)
groupdn="ldap:///cn=Administrators,dc=example,dc=com";)
Groupdn keyword containing logical OR of LDAP URLs groupdn = "ldap:///
cn=Administrators,dc=example,dc=com"
|| "ldap:///cn=Mail
Administrators,dc=example,dc=com"; The bind rule is evaluated to be true if the bind DN belongs to
either the
Administrators
or the
Mail Administrators
group.
Table 6.5. groupdn Examples
6.4.4. Defining Role Access - roledn Keyword
Members of a specific role can access a targeted resource. This is known as
role access
. Role access
is defined using the
roledn
keyword to specify that access to a targeted entry is granted or denied if
the user binds using a DN that belongs to a specific role.
The
roledn
keyword requires one or more valid distinguished names in the following format :
roledn = "ldap:/// dn [|| ldap:/// dn ]... [|| ldap:/// dn ]"
The bind rule is evaluated to be true if the bind DN belongs to the specified role.
NOTE
If a DN contains a comma, the comma must be escaped by a backslash (
\
).
The
roledn
keyword has the same syntax and is used in the same way as the
groupdn
keyword.
6.4.5. Defining Access Based on Value Matching
You can set bind rules to specify that an attribute value of the entry used to bind to the directory must
match an attribute value of the targeted entry.
For example, you can specify that the bind DN must match the DN in the
manager
attribute of a user
entry in order for the ACI to apply. In this case, only the user's manager would have access to the
entry.
This example is based on DN matching. However, you can match any attribute of the entry used in
the bind with the targeted entry. For example, you could create an ACI that allowed any user whose
favoriteDrink
attribute is
beer
to read all the entries of other users that have the same value for
favoriteDrink
.
6.4.5.1. Using the userattr Keyword
The
userattr
keyword can be used to specify which attribute values must match between the entry
used to bind and the targeted entry. You can specify any of the following:
• A user DN
• A group DN