Red Hat DIRECTORY SERVER 8.0, Руководство администратора, Страница: 169 / 552

Defining Targets
151
The following LDIF example allows members of the Engineering Admins group to modify the
departmentNumber
and
manager
attributes of all entries in the
Engineering
business category.
This example uses LDAP filtering to select all entries with
businessCategory
attributes set to
Engineering
:
dn: dc=example,dc=com
objectClass: top
objectClass: organization
aci: (targetattr="departmentNumber || manager")
(targetfilter="(businessCategory=Engineering)")
(version 3.0; acl "eng-admins-write"; allow (write)
groupdn ="ldap:///cn=Engineering Admins, dc=example,dc=com";)
NOTE
Although using LDAP filters can be useful when you are targeting entries and attributes
that are spread across the directory, the results are sometimes unpredictable because
filters do not directly name the object for which you are managing access. The set of
entries targeted by a filtered ACI is likely to change as attributes are added or deleted.
Therefore, if you use LDAP filters in ACIs, you should verify that they target the correct
entries and attributes by using the same filter in an
ldapsearch
operation.
6.3.2.5. Targeting Attribute Values Using LDAP Filters
You can use access control to target specific attribute values. This means that you can grant or deny
permissions on an attribute if that attribute's value meets the criteria defined in the ACI. An ACI that
grants or denies access based on an attribute's value is called a value-based ACI.
For example, you might grant all users in your organization permission to modify the
nsroledn
attribute in their own entry. However, you would also want to ensure that they do not give themselves
certain key roles, such as
Top Level Administrator
. LDAP filters are used to check that the
conditions on attribute values are satisfied.
To create a value-based ACI, you must use the
targattrfilters
keyword with the following
syntax:
(targattrfilters="add=attr1:F1 && attr2:F2... && attrn:Fn,del=attr1:F1 && attr2 : F2 ...
&& attrn : Fn ")
•
add
represents the operation of creating an attribute.
•
del
represents the operation of deleting an attribute.
•
attrx
represents the target attributes.
•
Fx
represents filters that apply only to the associated attribute.
When creating an entry, if a filter applies to an attribute in the new entry, then each instance of that
attribute must satisfy the filter. When deleting an entry, if a filter applies to an attribute in the entry, then
each instance of that attribute must also satisfy the filter.
When modifying an entry, if the operation adds an attribute, then the add filter that applies to that
attribute must be satisfied; if the operation deletes an attribute, then the delete filter that applies to that