HP UX Red Hat Direry Server Software manual Defining Access from a Specific Domain

Defining Access from a Specific Domain

ip = "12.123.1.*";

The bind rule is evaluated to be true if the client accessing the directory is located at the named IP address. This can be useful for allowing certain kinds of directory access only from a specific subnet or machine.

For example, use a wildcard IP address such as 12.3.45.* to specify a specific subnetwork or 123.45.6.*+255.255.255.115 to specify a subnetwork mask.

From the Directory Server Console, you can define specific machines to which the ACI applies through the Access Control Editor. For more information, see Section 5, “Creating ACIs from the Console”.

4.7. Defining Access from a Specific Domain

A bind rule can specify that the bind operation must originate from a particular domain or host machine. This is often used to force all directory updates to occur from a given machine or network domain.

The LDIF syntax for setting a bind rule based on the DNS hostname is as follows:

dns = "DNS_Hostname or dns != "DNS_Hostname

CAUTION

The dns keyword requires that the naming service used on your machine is DNS. If the name service is not DNS, use the ip keyword instead.

The dns keyword requires a fully qualified DNS domain name. Granting access to a host without specifying the domain creates a potential security threat. For example, the following expression is allowed but not recommended:

dns = "legend.eng";

Instead, use a fully qualified name:

dns = "legend.eng.example.com";

The dns keyword allows wildcards. For example:

dns = "*.example.com";

197