Access control attribute syntax

Edit online

The syntaxes for the new filter-based ACL attributes are modified versions of the current non-filter-based ACL attributes.

Each of these attributes can be managed by using LDIF notation. The following entry defines the syntax for the ACI and entryOwner attributes by using baccus naur form (BNF).

 <aclEntry> ::=<subject> [ ":"<rights> ] 

 <aclPropagate> ::="true" | "false"

 <ibm-filterAclEntry> ::=<subject>":" <object filter>[ ":"<rights> ] 

 <ibm-filterAclInherit> ::="true" | "false"

 <entryOwner> ::=<subject> 

 <ownerPropagate> ::= "true" | "false" 

 <subject> ::= <subjectDnType> ':' <subjectDn> | 
<pseudoDn> 

 <subjectDnType> ::= "role" | "group" | "access-id" 

 <subjectDn> ::= <DN> 

 <DN> ::= distinguished name as described in RFC 2251, section 4.1.3. 

 <pseudoDn> ::= "group:cn=anybody" | "group:cn=authenticated" | 
"access-id:cn=this"

 <object filter> ::= string search filter as defined in RFC 2254, section 4
		(extensible matching is not supported).

 <rights> ::= <accessList> [":" <rights> ] 

 <accessList> ::=<objectAccess> | <attributeAccess> | 
<attributeClassAccess> 

 <objectAccess> ::= "object:" [<action> ":"]<objectPermissions> 

 <action> ::= "grant" | "deny" 

 <objectPermissions> ::=<objectPermission> [ <objectPermissions> ] 

 <objectPermission> ::= "a" | "d" |"" 

 <attributeAccess> ::= "at." <attributeName> ":" [<action> ":"]
<attributePermissions> 

 <attributeName> ::= attributeType name as described in RFC 2251, section 4.1.4. 
(OID or alpha-numeric string with leading 
alphabet, "-" and ";" allowed) 

 <attributePermissions> ::=<attributePermission> 
[<attributePermissions>] 

 <attributePermission> ::="r" | "w" | "s" | "c" |"" 

 <attributeClassAccess> ::= <class> ":" [<action> ":"] 
<attributePermissions> 

 <class> ::= "normal" | "sensitive" | "critical" | "system" | "restricted"