HP UX Red Hat Direry Server Software manual Steps for expanding this ACI are as follows

Macro ACI Syntax

In this case, if the string matching ($dn) in the target is dc=subdomain1, dc=hostedCompany1, then the same string is used in the subject. The ACI is then expanded as follows:

aci: (target="ldap:///ou=Groups,dc=subdomain1,dc=hostedCompany1,

dc=example,dc=com") (targetattr = "*") (version 3.0; acl "Domain

access"; allow (read,search)

groupdn="ldap:///cn=DomainAdmins,ou=Groups,

dc=subdomain1,dc=hostedCompany1,dc=example,dc=com";)

Once the macro has been expanded, Directory Server evaluates the ACI following the normal process to determine whether access is granted.

10.2.2. Macro Matching for [$dn]

The matching mechanism for [$dn] is slightly different than for ($dn). The DN of the targeted resource is examined several times, each time dropping the left-most RDN component, until a match is found.

For example, you have an LDAP request targeted at the cn=all,ou=groups, dc=subdomain1,dc=hostedCompany1,dc=example,dc=com subtree and the following ACI:

aci: (target="ldap:///ou=Groups,($dn),dc=example,dc=com") (targetattr = "*") (version 3.0; acl "Domain access"; allow

(read,search) groupdn="ldap:///cn=DomainAdmins,ou=Groups,[$dn],dc=example,dc=com";)

The steps for expanding this ACI are as follows:

1.($dn) in the target matches dc=subdomain1,dc=hostedCompany1.

2.[$dn] in the subject is replaces with dc=subdomain1,dc=hostedCompany1.

The result is groupdn="ldap:///cn=DomainAdmins,ou=Groups, dc=subdomain1,dc=hostedCompany1,dc=example,dc=com". If the bind DN is a member of that group, the matching process stops, and the ACI is evaluated. If it does not match, the process continues.

3.[$dn] in the subject is replaced with dc=hostedCompany1.

The result is groupdn="ldap:///cn=DomainAdmins,ou=Groups, dc=hostedCompany1,dc=example,dc=com". In this case, if the bind DN is not a member of that group, the ACI is not evaluated. If it is a member, the ACI is evaluated.

The advantage of the [$dn] macro is that it provides a flexible way of granting access to domain-level administrators to all the subdomains in the directory tree. Therefore, it is useful for expressing a hierarchical relationship between domains.

239