ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

Group Matching
One of the most powerful methods for constructing access
control rules is to grant privlages to a group to which dns
can be dynamically added or removed. For example -
access to attr=userpassword
by group="cn=Administrators,dc=example,dc=com" write
would grant write access to any connection
authenticated to the DSA as a dn found in the
cn=Administrators. cn=Administrators is
expected to be of objectclass groupofnames
with member attributes containing dns.
dn:cn=adminstrators,dc=example,
dc=com
cn: adminstrators
objectclass: groupofNames
objectclass: top
member: cn=fred
blogs,dc=example,dc=com
member: cn=somebody
else,dc=example,dc=com
If another objectclass/attribute is required they
can be specified in the group clause, for
example - by group/organizationalRole/roleOccupant=
specifies an objectclass of organizationRole with attributes of
roleOccupant containing dns.