Examples of pseudo DNs are provided for your reference.
- Example 1
- Consider the following ACL for
object:cn=personA, o=sample
AclEntry: access-id: cn = this:critical:rwsc
AclEntry: group: cn=Anybody: normal:rsc
AclEntry: group: cn=Authenticated: sensitive:rcs
| User Binding as |
Would receive |
| cn=personA, o=sample |
normal:rsc:sensitive:rcs:critical:rwsc |
| cn=personB, o=sample |
normal:rsc:sensitive:rsc |
| NULL(unauth.) |
normal:rsc |
In this example, personA receives permissions that are granted
to the cn=this ID, and permissions that are given
to both the cn=Anybody and cn=Authenticated pseudo
DN groups.
- Example 2
- Consider the following ACL for
object:cn=personA, o=sample
AclEntry: access-id:cn=personA, o=sample: object:ad
AclEntry: access-id: cn = this:critical:rwsc
AclEntry: group: cn=Anybody: normal:rsc
AclEntry: group: cn=Authenticated: sensitive:rcs
For an
operation that is performed on cn=personA, o=sample:
| User Binding as |
Would receive |
| cn=personA, o=sample |
object:ad:critical:rwsc |
| cn=personB, o=sample |
normal:rsc:sensitive:rsc |
| NULL(unauth.) |
normal:rsc |
In this example, personA receives permissions that are granted
to the cn=this ID, and those permissions that are
given to the DN itself cn=personA, o=sample. The
group permissions are not given because there is a more specific acl
entry access-id:cn=personA, o=sample for the bind
DN cn=personA, o=sample.
- Example 3
- Consider the following ACL for object:
cn=personA, o=sample
AclEntry, where you want to give that user the ability to
change password: access-id:cn=this:at.userpassword:rwsc
| User Binding as |
Would receive |
| cn=personA, o=sample |
at.userpassword:rwsc |