Red Hat DIRECTORY SERVER 7.1, Руководство администратора

Страница: 220 / 652

Bind Rules
220 Red Hat Directory Server Administrator’s Guide • May 2005
Additionally, bind rules can be complex constructions that combine these criteria
by using Boolean operators. See “Using Boolean Bind Rules,” on page 236, for
more information.
Bind Rule Syntax
Whether access is allowed or denied depends on whether an ACI’s bind rule is
evaluated to be true. Bind rules use one of the two following patterns:
keyword
= "
expression
";
keyword
!= "
expression
";
where equal (=) indicates that
keyword
and
expression
must match in order for the
bind rule to be true, and not equal (!=) indicates that
keyword
and
expression
must
not match in order for the bind rule to be true.
The quotation marks (
""
) around
expression
and the delimiting semicolon (;) are
required. The expressions you can use depend on the associated
keyword
.
The following table lists each keyword and the associated expressions. It also
indicates whether wildcard characters are allowed in the expression.
NOTE
The timeofday keyword also supports the inequality expressions
(<, <=, >, >=). This is the only keyword that supports these
expressions.
Table 6-2 LDIF Bind Rule Keywords
Keyword Valid Expressions Wildcard Allowed?
userdn
ldap:/// distinguished_name
ldap:///all
ldap:///anyone
ldap:///self
ldap:///parent
ldap:/// suffix ??sub?( filter )
yes, in DN only
groupdn
ldap:/// DN || DN no
roledn
ldap:/// DN || DN no