18.11. Defining Bind Rules
- DNs
- Group memberships or assigned roles
- Locations from which an entry must bind
- Types of authentication that must be in use during the bind
- Times or days on which the bind occurs
(target_rule) (version 3.0; acl "ACL_name"; permission_rule bind_rules;)
Syntax
keyword comparison_operator "expression"
keyword
: Sets the type of the bind operation. See Section 18.11.1, “Frequently Used Bind Rules”.comparison_operator
: Valid values are=
and!=
and indicate whether or not the target is the object specified in the expression. If a keyword supports additional comparison operators, it is mentioned in the corresponding section.expression
: Sets the expression and must be surrounded by quotation marks. The expression itself depends on the keyword you use.
18.11.1. Frequently Used Bind Rules
userdn
: See Section 18.11.1.1, “Defining User-based Access”.groupdn
: See Section 18.11.1.2, “Defining Group-based Access”.
18.11.1.1. Defining User-based Access
userdn
keyword enables you to grant or deny access based on one or multiple DNs and uses the following syntax:
userdn comparison_operator "ldap:///distinguished_name || ldap:///distinguished_name || ..."
- An LDAP filter: See Section 18.11.1.1.2, “Using the
userdn
Keyword with an LDAP Filter”. - The
anyone
alias: See Section 18.11.1.1.3, “Granting Anonymous Access”. - The
all
alias: See Section 18.11.1.1.4, “Granting Access to Authenticated Users”. - The
self
alias: See Section 18.11.1.1.5, “Enabling Users to Access Their Own Entries”. - The
parent
alias: See Section 18.11.1.1.6, “Setting Access for Child Entries of a User”.
Note
18.11.1.1.1. Using a DN with the userdn
Keyword
userdn
keyword to a DN to apply the ACI only to the matching entry. To match multiple entries, use the *
wildcard in the DN.
userdn
keyword with a DN must match the following syntax:
userdn comparison_operator ldap:///distinguished_name
Example 18.12. Using a DN with the userdn
Keyword
uid=admin,ou=People,dc=example,dc=com
user to read the manager
attribute of all other users in the ou=People,dc=example,dc=com
entry:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr="manager") (version 3.0; acl "Allow uid=admin reading manager attribute"; allow (search, read) userdn = "ldap:///uid=admin,ou=People,dc=example,dc=com";)
18.11.1.1.2. Using the userdn
Keyword with an LDAP Filter
userdn
keyword with an LDAP filter:
userdn comparison_operator "ldap:///distinguished_name??scope?(filter)"
Note
*
wildcard.
Example 18.13. Using the userdn
Keyword with an LDAP Filter
department
attribute set to Human Resources
to update the homePostalAddress
attribute of users in the ou=People,dc=example,dc=com
entry:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr="homePostalAddress") (version 3.0; acl "Allow HR setting homePostalAddress"; allow (write) userdn = "ldap:///ou=People,dc=example,dc=com??sub?(department=Human Resources)";)
18.11.1.1.3. Granting Anonymous Access
- No bind DN and password
- A valid bind DN and password
ldap:///anyone
expression with the userdn
keyword in a bind rule:
userdn comparison_operator "ldap:///anyone"
Example 18.14. Granting Anonymous Access
sn
, givenName
, and telephoneNumber
attributes in the ou=People,dc=example,dc=com
entry:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr="sn" || targetattr="givenName" || targetattr = "telephoneNumber") (version 3.0; acl "Anonymous read, search for names and phone numbers"; allow (read, search) userdn = "ldap:///anyone";)
18.11.1.1.4. Granting Access to Authenticated Users
ldap:///all
expression with the userdn
keyword in a bind rule:
userdn comparison_operator "ldap:///all"
Example 18.15. Granting Access to Authenticated Users
ou=example,ou=groups,dc=example,dc=com
group:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=example,ou=Groups,dc=example,dc=com changetype: modify add: aci aci: (targetattr="member") (version 3.0; acl "Allow users to add/remove themselves from example group"; allow (selfwrite) userdn = "ldap:///all";)
18.11.1.1.5. Enabling Users to Access Their Own Entries
ldap:///self
expression with the userdn
keyword in a bind rule:
userdn comparison_operator "ldap:///self"
Example 18.16. Enabling Users to Access Their Own Entries
ou=People,dc=example,dc=com
entry to update their own userPassword
attribute:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr="userPassword") (version 3.0; acl "Allow users updating their password"; allow (write) userdn = "ldap:///self";)
18.11.1.1.6. Setting Access for Child Entries of a User
self:///parent
expression with the userdn
keyword in a bind rule:
userdn comparison_operator "ldap:///parent"
Example 18.17. Setting Access for Child Entries of a User
cn=user,ou=People,dc=example,dc=com
user to update the manager
attribute of its own sub-entries, such as cn=example,cn=user,ou=People,dc=example,dc=com
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=user,ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr="manager") (version 3.0; acl "Allow cn=user to update manager attributes"; allow (write) userdn = "ldap:///parent";)
18.11.1.2. Defining Group-based Access
groupdn
keyword. If the user is a member of one or multiple of the specified groups, the ACI matches.
groupdn
keyword, Directory Server verifies the group membership based on the following attributes:
member
uniqueMember
memberURL
memberCertificateDescription
groupdn
keyword use the following syntax:
groupdn comparison_operator "ldap:///distinguished_name || ldap:///distinguished_name || ..."
- An LDAP filter. See Section 18.11.1.2.2, “Using the
groupdn
Keyword with an LDAP Filter”.
groupdn
keywords and combine them using the Boolean and
operator. For details, see Section 18.11.3, “Combining Bind Rules Using Boolean Operators”.
Note
18.11.1.2.1. Using a DN with the groupdn
Keyword
groupdn
keyword to the group's DN.
groupdn
keyword set to a DN uses the following syntax:
groupdn comparison_operator ldap:///distinguished_name
Example 18.18. Using a DN with the groupdn
Keyword
cn=example,ou=Groups,dc=example,dc=com
group to search and read the manager
attribute of entries in ou=People,dc=example,dc=com
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr="manager") (version 3.0; acl "Allow example group to read manager attribute"; allow (search, read) groupdn = "ldap:///cn=example,ou=Groups,dc=example,dc=com";)
18.11.1.2.2. Using the groupdn
Keyword with an LDAP Filter
groupdn
keyword, you can define that the authenticated user must be a member of at least one of the groups that the filter search returns, to match the ACI.
groupdn
keyword with an LDAP filter uses the following syntax:
groupdn comparison_operator "ldap:///distinguished_name??scope?(filter)"
Note
*
wildcard.
Example 18.19. Using the groupdn
Keyword with an LDAP Filter
dc=example,dc=com
and subtrees, which have the manager
attribute set to example
, update the homePostalAddress
of entries in ou=People,dc=example,dc=com
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr="homePostalAddress") (version 3.0; acl "Allow manager=example setting homePostalAddress"; allow (write) userdn = "ldap:///dc=example,dc=com??sub?(manager=example)";)
18.11.2. Further Bind Rules
18.11.2.1. Defining Access Based on Value Matching
userattr
keyword in a bind rule to specify which attribute must match between the entry used to bind to the directory and the targeted entry.
userattr
keyword uses the following syntax:
userattr comparison_operator "attribute_name#bind_type_or_attribute_value
Important
add
permissions to the entry where you set the ACI, when using the userattr
keyword. To configure this behavior, use the userattr
keyword in conjunction with the parent
keyword and grant the permission additionally on level 0
.
userattr
Keyword with Inheritance”.
18.11.2.1.1. Using the USERDN
Bind Type
USERDN
bind type.
userattr
keyword with the USERDN
bind type requires the following syntax:
userattr comparison_operator "attribute_name#USERDN"
Example 18.20. Using the USERDN
Bind Type
telephoneNumber
attribute of its own associates:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr = "telephoneNumber") (version 3.0; acl "Manager: telephoneNumber"; allow (all) userattr = "manager#USERDN";)
ou=People,dc=example,dc=com
, matches the DN stored in the manager
attribute of this entry.
18.11.2.1.2. Using the GROUPDN
Bind Type
GROUPDN
bind type.
userattr
keyword with the GROUPDN
bind type requires the following syntax:
userattr comparison_operator "attribute_name#GROUPDN"
Example 18.21. Using the GROUPDN
Bind Type
ou=Social Committee,ou=Groups,dc=example,dc=com
entry:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=Social Committee,ou=Groups,dc=example,dc=com changetype: modify add: aci aci: (target="ou=Social Committee,ou=Groups,dc=example,dc=com) (targattrfilters="del=objectClass:(objectClass=groupOfNames)") (version 3.0; acl "Delete Group"; allow (delete) userattr = "owner#GROUPDN";)
owner
attribute.
userattr comparison_operator "ldap:///distinguished_name?attribute_name#GROUPDN"
18.11.2.1.3. Using the ROLEDN
Bind Type
ROLEDN
bind type.
userattr
keyword with the ROLEDN
bind type requires the following syntax:
userattr comparison_operator "attribute_name#ROLEDN"
Example 18.22. Using the ROLEDN
Bind Type
cn=Administrators,dc=example,dc=com
role to search and read the manager
attribute of entries in ou=People,dc=example,dc=com
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (version 3.0; acl "Allow example role owners to read manager attribute"; allow (search, read) userattr = manager#ROLEDN;)
18.11.2.1.4. Using the SELFDN
Bind Type
SELFDN
bind type enables you to grant permissions, when the bound user's DN is set in a single-value attribute of the entry.
userattr
keyword with the SELFDN
bind type requires the following syntax:
userattr comparison_operator "attribute_name#SELFDN"
Example 18.23. Using the SELFDN
Bind Type
ipatokenuniqueid=*,cn=otp,dc=example,dc=com
entries that have the bind user's DN set in the ipatokenOwner
attribute:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=otp,dc=example,dc=com changetype: modify add: aci aci: (target = "ldap:///ipatokenuniqueid=*,cn=otp,dc=example,dc=com") (targetfilter = "(objectClass=ipaToken)")(version 3.0; acl "token-add-delete"; allow (add) userattr = "ipatokenOwner#SELFDN";)
18.11.2.1.5. Using the LDAPURL
Bind Type
LDAPURL
bind type.
userattr
keyword with the LDAPURL
bind type requires the following syntax:
userattr comparison_operator "attribute_name#LDAPURL"
Example 18.24. Using the LDAPURL
Bind Type
aciurl
attribute set to ldap:///ou=People,dc=example,dc=com??one?(uid=user*)
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr = "*") (version 3.0; acl "Allow read,search "; allow (read,search) (userattr = "aciurl#LDAPURL);)
18.11.2.1.6. Using the userattr
Keyword with Inheritance
userattr
keyword to associate the entry used to bind with the target entry, the ACI applies only to the target specified and not to the entries below it. In certain situations, administrators want to extend the application of the ACI several levels below the targeted entry. This is possible by using the parent
keyword and specifying the number of levels below the target that should inherit the ACI.
userattr
keyword with the parent
keyword, the syntax is as follows:
userattr comparison_operator "parent[inheritance_level].attribute_name#bind_type_or_attribute_value
- inheritance_level: Comma-separated list that indicates how many levels below the target inherit the ACI. You can include five levels (
0
,1
,2
,3
,4
) below the targeted entry. Zero (0
) indicates the targeted entry. - attribute_name: The attribute targeted by the
userattr
orgroupattr
keyword. - bind_type_or_attribute_value: Sets the attribute value or a bind type, such as
USERDN
.
userattr = "parent[0,1].manager#USERDN"
Example 18.25. Using the userattr
Keyword with Inheritance
cn=Profiles,dc=example,dc=com
entry where the user's DN is set in the owner
attribute, as well as the first level of child entries which includes cn=mail,cn=Profiles,dc=example,dc=com
and cn=news,cn=Profiles,dc=example,dc=com
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=Profiles,dc=example,dc=com changetype: modify add: aci aci: (targetattr="*") (version 3.0; acl "Profile access", allow (read,search) userattr="parent[0,1].owner#USERDN" ;)
18.11.2.2. Defining Access from Specific IP Addresses or Ranges
ip
keyword in a bind rule enables you to grant or deny access from a specific IP address or a range of IP addresses.
ip
keyword use the following syntax:
ip comparison_operator "IP_address_or_range"
Example 18.26. Using IPv4 Address Ranges in Bind Rules
192.0.2.0/24
network to the dc=example,dc=com
entry:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: dc=example,dc=com changetype: modify add: aci aci: (targetattr = "*") (version 3.0;acl "Deny 192.0.2.0/24"; deny (all) (userdn = "ldap:///anyone") and (ip != "192.0.2.");)
Example 18.27. Using IPv6 Address Ranges in Bind Rules
2001:db8::/64
network to the dc=example,dc=com
entry:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: dc=example,dc=com changetype: modify add: aci aci: (targetattr = "*") (version 3.0;acl "Deny 2001:db8::/64"; deny (all) (userdn = "ldap:///anyone") and (ip != "2001:db8::");)
18.11.2.3. Defining Access from a Specific Host or Domain
dns
keyword in a bind rule enables you to grant or deny access from a specific host or domain.
Warning
dns
bind rule for this client.
ip
keyword and IP addresses instead. See Section 18.11.2.2, “Defining Access from Specific IP Addresses or Ranges”.
dns
keyword use the following syntax:
dns comparison_operator "host_name_or_domain_name"
Example 18.28. Defining Access from a Specific Host
client.example.com
host to the dc=example,dc=com
entry:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: dc=example,dc=com changetype: modify add: aci aci: (targetattr = "*") (version 3.0;acl "Deny client.example.com"; deny (all) (userdn = "ldap:///anyone") and (dns != "client.example.com");)
Example 18.29. Defining Access from a Specific Domain
example.com
domain to the dc=example,dc=com
entry:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: dc=example,dc=com changetype: modify add: aci aci: (targetattr = "*") (version 3.0;acl "Deny example.com"; deny (all) (userdn = "ldap:///anyone") and (dns != "*.example.com");)
18.11.2.4. Requiring a Certain Level of Security in Connections
ssf
keyword in a bind rule, you can set that a connection must use a certain level of security. This enables you to force operations, for example password changes, to be performed over an encrypted connection.
ssf
keyword use the following syntax:
ssf comparison_operator key_strength
=
(equal to)!
(not equal to)<
(less than)>
(greater than)<=
(less than or equal to)>=
(greater than or equal to)
key_strength
parameter is set to 0
, no secure operation is required for the LDAP operation.
Example 18.30. Requiring a Certain Level of Security in Connections
dc=example,dc=com
entry can only update their userPassword
attribute when the SSF is 128
or higher:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: dc=example,dc=com changetype: modify add: aci aci: (targetattr = "userPassword") (version 3.0; acl "Allow users updating own userPassword"; allow (write) (userdn = "ldap:///self") and (ssf >= "128");)
18.11.2.5. Defining Access at a Specific Day of the Week
dayofweek
keyword in a bind rule enables you to grant or deny access based on the day of the week.
Note
dayofweek
keyword use the following syntax:
dayofweek comparison_operator "comma-separated_list_of_days"
Example 18.31. Granting Access on Specific Days of the Week
uid=user,ou=People,dc=example,dc=com
user entry to bind to the server on Saturdays and Sundays:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (version 3.0; acl "Deny access on Saturdays and Sundays"; deny (all) (userdn = "ldap:///uid=user,ou=People,dc=example,dc=com") and (dayofweek = "Sun,Sat");)
18.11.2.6. Defining Access at a Specific Time of Day
timeofday
keyword in a bind rule enables you to grant or deny access based on the time of day.
Note
timeofday
keyword use the following syntax:
timeofday comparison_operator "time"
=
(equal to)!
(not equal to)<
(less than)>
(greater than)<=
(less than or equal to)>=
(greater than or equal to)
Important
timeofday
keyword requires that you specify the time in 24-hour format.
Example 18.32. Defining Access at a Specific Time of a Day
uid=user,ou=People,dc=example,dc=com
user entry to bind to the server between 6pm and 0am:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (version 3.0; acl "Deny access between 6pm and 0am"; deny (all) (userdn = "ldap:///uid=user,ou=People,dc=example,dc=com") and (timeofday >= "1800" and timeofday < "2400");)
18.11.2.7. Defining Access Based on the Authentication Method
authmethod
keyword in a bind rule sets what authentication method a client must use when connecting to the server, to apply the ACI.
authmethod
keyword use the following syntax:
authmethod comparison_operator "authentication_method"
none
: Authentication is not required and represents anonymous access. This is the default.simple
: The client must provide a user name and password to bind to the directory.SSL
: The client must bind to the directory using a TLS certificate either in a database, smart card, or other device. For details about certificate-based authentication, see Section 9.9, “Using Certificate-based Client Authentication”.SASL
: The client must bind to the directory over a Simple Authentication and Security Layer (SASL) connection. When you use this authentication method in a bind rule, additionally specify the SASL mechanism, such asEXTERNAL
.
Example 18.33. Enabling Access Only for Connections Using the EXTERNAL
SASL Authentication Method
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (version 3.0; acl "Deny all access without certificate"; deny (all) (authmethod = "none" or authmethod = "simple");)
18.11.2.8. Defining Access Based on Roles
roledn
keyword in a bind rule enables you to grant or deny access to users having one or multiple role sets.
Note
roledn
keyword use the following syntax:
roledn comparison_operator "ldap:///distinguished_name || ldap:///distinguished_name || ..."
Note
Example 18.34. Defining Access Based on Roles
cn=Human Resources,ou=People,dc=example,dc=com
role set in the nsRole
attribute to search and read the manager
attribute of entries in ou=People,dc=example,dc=com
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (targetattr="manager") (version 3.0; acl "Allow manager role to update manager attribute"; allow (search, read) roledn = "ldap:///cn=Human Resources,ou=People,dc=example,dc=com";)
18.11.3. Combining Bind Rules Using Boolean Operators
AND
, OR
, and NOT
Boolean operators enable you to combine multiple keywords.
bind_rule_1 boolean_operator bind_rule_2...
Example 18.35. Combining Bind Rules Using Boolean Operators
cn=Administrators,ou=Groups,dc=example,com
and cn=Operators,ou=Groups,dc=example,com
group can read, search, add, update, and delete entries in ou=People,dc=example,dc=com
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: ou=People,dc=example,dc=com changetype: modify add: aci aci: (target="ldap:///ou=People,dc=example,dc=com") (version 3.0; acl "Allow members of administrators and operators group to manage users"; allow (read, search, add, write, delete) groupdn = "ldap:///cn=Administrators,ou=Groups,dc=example,com" AND groupdn = "ldap:///cn=Operators,ou=Groups,dc=example,com";)
How Directory Server Evaluates Boolean Operators
- All expressions from left to right.In the following example,
bind_rule_1
is evaluated first:(bind_rule_1) OR (bind_rule_2)
- From innermost to outermost parenthetical expressions first.In the following example,
bind_rule_2
is evaluated first andbind_rule_3
second:(bind_rule_1) OR ((bind_rule_2) AND (bind_rule_3))
NOT
beforeAND
orOR
operators.In the following example,bind_rule_2
is evaluated first:(bind_rule_1) AND NOT (bind_rule_2)
TheAND
andOR
operators have no order of precedence.