Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Руководство администратора

Страница: 228 / 578

Bind Rules
228 Netscape Directory Server Administrator’s Guide • August 2002
authmethod = "ssl";
The bind rule is evaluated to be true if the client authenticates to the directory
using a certificate over LDAPS. This is not evaluated to be true if the client
authenticates using simple authentication (bind DN and password) over ldaps.
authmethod = "sasl DIGEST-MD5";
The bind rule is evaluated to be true if the client is accessing the directory using
the SASL DIGEST-MD5 mechanism. The other supported SASL mechanism is
EXTERNAL.
Using Boolean Bind Rules
Bind rules can be complex expressions that use the Boolean expressions
AND
,
OR
,
and
NOT
to set very precise access rules. You cannot use the Server Console to
create Boolean bind rules. You must create an LDIF statement.
The LDIF syntax for a Boolean bind rule is as follows:
bind_rule
[
boolean
][
bind_rule
][
boolean
][
bind_rule
]...;)
For example, the following bind rule will be evaluated to be true if the bind DN is a
member of either the administrator’s group or the mail administrator’s group, and
if the client is running from within the
example.com
domain:
(groupdn = "ldap:///cn=administrators,dc=example,dc=com" or groupdn
= "ldap:///cn=mail administrators,dc=example,dc=com" and dns =
"*.example.com";)
The trailing semicolon (;) is a required delimiter that must appear after the final
bind rule.
Boolean expressions are evaluated in the following order:
• Innermost to outermost parenthetical expressions first
• All expressions from left to right
• NOT before AND or OR operators
The Boolean
OR
and Boolean
AND
operators have no order of precedence.
Consider the following Boolean bind rules:
(
bind_rule_A
) OR (
bind_rule_B
)
(
bind_rule_B
) OR (
bind_rule_A
)