Oracle Internet Directory Administrator's Guide Release 2.1.1 Part Number A86101-01 |
Library | Service | Contents | Index

# D
Using Access Control Directive Format

This appendix describes the format (syntax) of any Access Control Information Item (ACI).

This appendix contains these topics:

- Schema for orclACI

- Schema for orclEntryLevelACI

## Schema for orclACI

The access control directive defined by the user attribute orclACI has the following schema:

    OrclACI:

    { object_identifier NAME 'orclACI' DESC 'Stores an inheritable ACI' EQUALITY

    accessDirectiveMatch SYNTAX 'accessDirectiveDescription'  USAGE

    'directoryOperation'}

accessDirectiveDescription has the following BNF:

    <accessDirectiveDescription>
                      ::= access to <object> [by <subject> ( <accessList> )]+

    <object> ::= [attr <EQ-OR-NEQ> (<attrList>) | entry] [filter=(<ldapFilter>)]

    <subject> ::= <entity> [<BindMode>]

    <entity> ::= * | self | dn="<regex>" | dnAttr=(<dn_attribute>) | group="<dn>"

    <BindMode> ::= | BindMode = Simple
                   | BindMode = SSLNoauth
                   | BindMode = SSLOneway
                   | BindMode = SSLTwoway

    <accessList> ::= <access> | <access>, <accessList>

    <access> ::= none | compare | search | browse | read | selfwrite | write | add
    |delete | nocompare | nosearch | nobrowse |noread | noselfwrite | nowrite |
    noadd | nodelete

    <attrList> ::=  *| <attribute name> | <attribute name>,<attrList>

    <EQ-OR-NEQ> ::=  = | !=

    <regex> ::= <dn> | *,<dn_of_any_subtree_root>

Note: The regular expression defined above is not meant to match any arbitrary expression. The syntax only allows expressions where the wild card is followed by a comma and a valid DN. The latter DN denoted by <dn_of_any_subtree_root> is intended to specify the root of some subtree.

## Schema for orclEntryLevelACI

The entry level access control directive defined by the user attribute orclEntryLevelACI has the following schema:

    "orclEntryLevelACI":

    { object_identifier NAME 'orclEntryLevelACI' DESC 'Stores entry level ACL
    Directive'

    EQUALITY accessDirectiveMatch SYNTAX 'orclEntryLevelACIDescription'

    USAGE 'directoryOperation' }

    <orclEntryLevelACIDescription>

    ::= access to <object> [by <subject> ( <accessList> )]+

| Copyright © 1996-2000, Oracle Corporation. All Rights Reserved. |
Library | Service | Contents | Index