ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

Regular Expression Matching
The use of regular expressions in the matching pattern provides the
ability to construct intelligent and extrememly powerful access
control rules.
Example:
access to dn="cn=([^,]+),ou=ListAliases,ou=MailAliases,o=Morrison Industries,c=US"
by group/groupOfUniqueNames/uniquemember="cn=$1 ListAlias,ou=ACLGroups,o=Morrison Industries,c=US" write
by group/groupOfUniqueNames/uniquemember="cn=CIS Dept,ou=ACLGroups,o=Morrison Industries, c=US" write
by * read
The above rule grants uniquemembers of the CIS Dept object under
ou=ACLGroups write access to all objects directly under
ou=ListAliases. For each object under ou=ListAliases a
correspondingly named object under ou=ACLGroups is used to grant
per object access to an arbitrary group of uniquemembers. So a
uniquemember of object cn=Staff ListAlias,ou=ACLGroups,.... would
have write access to the object cn=Staff,ou=MailAliases,..... All other
connections would have read access.