PingDirectory

Result criteria

Use result criteria to match operations based on the content of the result or the associated request or client connection.

Simple result criteria

Use simple result criteria to match results based on a broad set of properties.

These properties include the following.

Property Description

request-criteria

An optional reference to a request criteria object that must match the operation for this criteria to match.

result-code-criteria

Specifies the criteria that the operation’s result code must match for this criteria to match. Allowed values include:

all-result-codes

Any result code can match. This is the default behavior.

non-failure-result-codes

Only operations with non-failure result codes (success, compareFalse, compareTrue, referral, saslBindInProgress, and noOperation) can match this criteria.

failure-result-codes

Only operations with failure result codes (all result codes other than the non-failure result codes) can match this criteria.

selected-result-codes

Only operations with one of the result codes listed in the result-code-value property can match this criteria.

result-code-value

The set of result codes that an operation might have to match this criteria. This is only used if the result-code-criteria property has a value of selected-result-codes. Values can include any result code that the PingDirectory server can use.

processing-time-criteria

Specifies the criteria that the operation’s processing time must satisfy for this criteria to match. Allowed values include:

less-than-or-equal-to

Indicates that only operations with a processing time that is less than or equal to the value of the processing-time-value property can match this criteria.

greater-than-or-equal-to

Indicates that only operations with a processing time that is greater than or equal to the value of the processing-time-value property can match this criteria.

any

Indicates that operations with any processing time can match this criteria. This is the default value for this property.

processing-time-value

The duration to use in conjunction with the processing-time-criteria property. This property is ignored if the processing-time-criteria property has a value of any.

queue-time-criteria

Specifies the criteria that the operation’s queue time (the time that it spent waiting in the work queue before it was picked up by a worker thread) must satisfy for this criteria to match. Allowed values include:

less-than-or-equal-to

Indicates that only operations with a processing time that is less than or equal to the value of the processing-time-value property can match this criteria.

greater-than-or-equal-to

Indicates that only operations with a processing time that is greater than or equal to the value of the processing-time-value property can match this criteria.

any

Indicates that operations with any processing time can match this criteria. This is the default value for this property.

queue-time-value

The duration to use in conjunction with the queue-time-criteria property. This property is ignored if the queue-time-criteria property has a value of any.

referral-returned

Indicates whether this criteria should match operations that included one or more referral URLs. Allowed values include:

required

Indicates that this criteria only matches operations that include one or more referral URLs.

prohibited

Indicates that this criteria does not match operations that include any referral URLs.

optional

Indicates that this criteria can match operations regardless of whether they contain referral URLs. This is the default value for this property.

all-included-response-control

An optional set of the OIDs of controls that might be included in responses that can match this criteria. If multiple OIDs are specified, then the operation must include all of those response controls.

any-included-response-control

An optional set of the OIDs of controls that might be included in responses that can match this criteria. If multiple OIDs are specified, then the operation must include at least one of those response controls.

not-all-included-response-control

An optional set of the OIDs of controls that should not be included in responses that might match this criteria. If multiple OIDs are specified, then the operation can optionally include one or more of those controls as long as it does not include all of them.

none-included-response-control

An optional set of the OIDs of controls that should not be included in responses that can match this criteria. If multiple OIDs are specified, then the operation must not include any of those response controls.

used-alternate-authzid

Indicates whether this criteria should match operations that used an authorization identity that is different from the authentication identity (for example, as a result of the proxied authorization request control). Allowed values include:

required

Indicates that this criteria only matches operations that include one or more referral URLs.

prohibited

Indicates that this criteria does not match operations that include any referral URLs.

optional

Indicates that this criteria can match operations regardless of whether they contain referral URLs. This is the default value for this property.

used-any-privilege

Indicates whether this criteria should match operations in which the requester used one or more privileges.

required

Indicates that this criteria only matches operations in which the requester used one or more privileges.

prohibited

Indicates that this criteria only matches operations in which the requester did not use any privileges.

optional

Indicates that this criteria can match operations regardless of whether the requester used any privileges.

used-privilege

An optional set of the privileges that the requester might have used for this criteria to match the operation. If multiple privileges are specified, then the requester must have used at least one of those privileges.

missing-any-privilege

Indicates whether this criteria should match operations in which the requester was missing one or more required privileges.

required

Indicates that this criteria only matches operations in which the requester was missing one or more privileges.

prohibited

Indicates that this criteria only matches operations in which the requester was not missing any privileges.

optional

Indicates that this criteria can match operations regardless of whether the requester was missing any required privileges.

missing-privilege

An optional set of the privileges that were required for the associated operation that the requester must have been missing for this criteria to match. If multiple privileges are specified, then the requester must have been missing at least one of those privileges.

retired-password-used-for-bind

Indicates whether this criteria should match bind operations based on whether the client authenticated with a retired password. This property is ignored for all operations other than bind. Allowed values include:

retired-password-used

Indicates that this criteria only matches bind operations in which the user authenticated with a retired password.

retired-password-not-used

Indicates that this criteria only matches bind operations in which the user did not authenticate with a retired password.

any

Indicates that this criteria can match bind operations regardless of whether the user authenticated with a retired password. This is the default value for the property.

search-entry-returned-criteria

Specifies the criteria for the number of entries returned in response to a search operation that operations matching this criteria should use. This property is ignored for all operations other than search. Allowed values include:

equal-to

Indicates that this criteria only matches search operations in which the number of entries returned matches the value of the search-entry-returned-count property.

not-equal-to

Indicates that this criteria only matches search operations in which the number of entries returned does not match the value of the search-entry-returned-count property.

greater-than-or-equal-to

Indicates that this criteria only matches search operations in which the number of entries returned is greater than or equal to the value of the search-entry-returned-count property.

less-than-or-equal-to

Indicates that this criteria only matches search operations in which the number of entries returned is less than or equal to the value of the search-entry-returned-count property.

any

Indicates that this criteria can match search operations regardless of the number of entries that were returned. This is the default value for the property.

included-authz-user-base-dn

An optional set of base DNs below which the operation’s authorization identity might exist for the criteria to match.

excluded-authz-user-base-dn

An optional set of base DNs below which the operation’s authorization identity must not exist for the criteria to match.

all-included-authz-user-group-dn

An optional set of the DNs of groups in which the operation’s authorization identity must be a member for this criteria to match. If multiple group DNs are specified, then the user must be a member of all of those groups.

any-included-authz-user-group-dn

An optional set of the DNs of groups in which the operation’s authorization identity must be a member for this criteria to match. If multiple group DNs are specified, then the user must be a member of at least one of those groups.

not-all-included-authz-user-group-dn

An optional set of the DNs of groups in which the operation’s authorization identity should not be a member for this criteria to match. If multiple group DNs are specified, then the user can optionally be a member of one or more of those groups as long as it is not a member of all of them.

none-included-authz-user-group-dn

An optional set of the DNs of groups in which the operation’s authorization identity should not be a member for this criteria to match. If multiple group DNs are specified, then the user must not be a member of any of them.

The default settings for the simple result criteria matches any operation. If you set values for multiple properties, then it essentially behaves as a logical AND, and the criteria only matches operations that match all of those properties.

Replication assurance result criteria

Use replication assurance result criteria to match operations based on their use of assured replication, whether based on a request control or criteria, and whether the constraints were satisfied.

Property Description

local-assurance-level

The set of local replication assurance levels that can be in use for the criteria to match. By default, this property has all three of the following possible values:

none

Indicates that the criteria should match if the operation does not expect any degree of local assurance.

received-any-server

Indicates that the criteria should match if the operation expects that the change will be received by at least one other local server before the response is returned to the client.

processed-all-servers

Indicates that the criteria should match if the operation expects that the change will be processed by all other available local servers before the response is returned to the client.

remote-assurance-level

The set of remote replication assurance levels that might be in use for the criteria to match. By default, this property has all four of the following possible values:

none

Indicates that the criteria should match if the operation does not expect any degree of remote assurance.

received-any-remote-location

Indicates that the criteria should match if the operation expects that the change will be received by at least one server in at least one remote location before the response is returned to the client.

received-all-remote-locations

Indicates that the criteria should match if the operation expects that the change will be received by at least one server in all of the remote locations before the response is returned to the client.

processed-all-remote-servers

Indicates that the criteria should match if the operation expects that the change will be processed by all available servers in all remote locations before the response is returned to the client.

assurance-timeout-criteria

Indicates the criteria that should be used to match the assurance timeout. Allowed values include:

less-than-or-equal-to

Indicates that the criteria can match if the assurance timeout is less than or equal to the value contained in the assurance-timeout-value property.

greater-than-or-equal-to

Indicates that the criteria can match if the assurance timeout is greater than or equal to the value contained in the assurance-timeout-value property.

any

Indicates that the assurance timeout is not considered when deciding whether the criteria matches the operation. This is the default value for the property.

assurance-timeout-value

The duration value used in conjunction with the assurance-timeout-criteria. This is ignored if the assurance-timeout-criteria value is any.

response-delayed-by-assurance

Indicates whether the criteria should match an operation based on whether the operation response was delayed by replication assurance processing. Allowed values include:

true

Indicates that the criteria can match if the operation response was delayed by assurance processing.

false

Indicates that the criteria does not match if the operation response was delayed by assurance processing.

any

Indicates that the criteria does not depend on whether the response was delayed by replication assurance processing. This is the default value for the property.

assurance-behavior-altered-by-control

Indicates whether the criteria should match an operation based on whether it included an assured replication request control that used different assurance criteria than the server would have otherwise used for the operation.

true

Indicates that the criteria can match if the operation included an assured replication request control with different criteria than would otherwise be used.

false

Indicates that the criteria can match if the operation did not include an assured replication request control or if it included a control with the same behavior that the server would have used without the control.

any

Indicates that the criteria does not depend on whether the assurance behavior was altered by a control. This is the default value for the property.

assurance-satisfied

Indicates whether the criteria should match the operation based on whether the assurance constraints were satisfied.

both-satisfied

Indicates that the criteria can match if both the local and remote assurance requirements were satisfied.

either-satisfied

Indicates that the criteria can match if one or both of the local and remote assurance requirements were satisfied.

at-least-local-satisfied

Indicates that the criteria can match if the local assurance requirements were satisfied, regardless of whether the remote requirements were satisfied.

at-least-remote-satisfied

Indicates that the criteria can match if the remote assurance requirements were satisfied, regardless of whether the local requirements were satisfied.

only-local-satisfied

Indicates that the criteria can match if the local assurance requirements were satisfied, but the remote requirements were not satisfied.

only-remote-satisfied

Indicates that the criteria can match if the remote assurance requirements were satisfied, but the local requirements were not satisfied.

either-not-satisfied

Indicates that the criteria can match if one or both of the local or remote requirements were not satisfied.

at-least-local-not-satisfied

Indicates that the criteria can match if the local assurance requirements were not satisfied, regardless of whether the remote requirements were satisfied.

at-least-remote-not-satisfied

Indicates that the criteria can match if the remote assurance requirements were not satisfied, regardless of whether the local requirements were satisfied.

neither-satisfied

Indicates that the criteria can match if neither the local nor the remote criteria were satisfied.

any

Indicates that the criteria does not depend on whether the assurance constraints were satisfied. This is the default value for the property.

Aggregate result criteria

Use aggregate result criteria to create a single result criteria that combines multiple other result criteria objects.

Aggregate result criteria offers the following properties.

Property Description

all-included-result-criteria

An optional set of the result criteria objects that must all match the result for this aggregate criteria to match.

any-included-result-criteria

An optional set of the result criteria objects in which at least one of those criteria objects must match the result for this aggregate criteria to match.

not-all-included-result-criteria

An optional set of the result criteria objects in which at least one of those criteria objects must not match the result for this aggregate criteria to match.

none-included-result-criteria

An optional set of the result criteria objects in which none of those objects might match the result for this aggregate criteria to match.