ACI bind rules

The userdn bind rule is used to target a requester based on their authenticated identity. The value of this bind rule must be in the form of an Lightweight Directory Access Protocol (LDAP) URL although in some cases it might not actually be a valid URL (for example, because the distinguished name (DN) element is not actually a valid DN). The LDAP URL can take several forms, including:

The userdn bind rule can also contain multiple LDAP URLs. In that case, each URL should be separated by two consecutive vertical bar characters ||: (“userdn="ldap:///uid=jdoe,ou=People,dc=example, dc=com || uid=jpublic,ou=People,dc=example,dc=com"”).

The != operator can be used as an alternative to the = operator: userdn!="ldap:///uid=admin,ou=People,dc=example,dc=com". In that case, the bind rule matches if the provided value does not match the authenticated identity.

The groupdn bind rule is used to target a requester based on their group membership. The value of this bind rule must be an LDAP URL, such as groupdn="ldap:///cn=Admin Users,ou=Groups,dc=example,dc=com". Only the DN element of the URL is used, and that DN must not contain any wildcards or parameterization.

The groupdn bind rule considers both direct group membership and nested membership such as if the user is a member of a group that is itself a member of a group listed in the groupdn value.

As with the userdn bind rule, the value of the groupdn bind rule can include multiple LDAP URLs separated by two consecutive vertical bar characters.

The != operator can be used as an alternative to the = operator: groupdn!="ldap:///cn=Administrators,ou=Groups,dc=example,dc=com". In that case, the bind rule matches if authenticated user is not a member of the specified group.

The connectioncriteria bind rule allows or denies an operation based on whether the client connection matches a given connection criteria definition.

If present in an access control rule, the operator must be either "=" or "!=". The value must be enclosed in quotation marks, and it must be the name or full DN of the configuration object that defines the desired connection criteria.

For example, you can use a modification like the following to allow any client matching the "Root Users and Topology Administrators" connection criteria to have full read and write access to entries below dc=example,dc=com:

The secure bind rule allows or denies an operation based on whether the client is communicating with the server over a secure connection; for example, using LDAPS or StartTLS over LDAP.

If present in an access control rule, the operator must be either "=" or "!=", and the value must be either "true" or "false" including the quotation marks. With this in mind, the secure bind rule takes the following forms:

For example, you can use a modification like the following to allow users below dc=example,dc=com to update their own passwords over a secure connection:

The userattr bind rule can be used to target a requester based on their relation to the value of an attribute in the target entry. The value of the bind rule should contain the name of an attribute followed by the octothorpe character (#) and a keyword or attribute value.

There are four forms that userattr values can take:

When using the USERDN keyword, you can optionally specify a parent component to indicate that the target entry can be up to four levels below the authenticated user’s entry. In this case, the word parent should be followed by an opening square bracket ([), a comma-delimited list of digits between 0 and 4 (inclusive), a closing square bracket (]), a period, and the rest of the value. A value of zero matches if the attribute value contains a DN that matches that of the authenticated user, while A value of four matches if the attribute value contains a DN that is exactly four levels below the authenticated user’s entry. For example, userattr="parent[0,1,2,3,4].manager#USERDN" can be used to allow an operation if it targets a user whose manager attribute contains a value that matches the DN of the authenticated user or is up to four levels below that DN.

The != operator can be used as an alternative to the = operator such as userattr!="manager#USERDN". In that case, the bind rule matches if the provided value does not match for the authenticated user.

The authmethod bind rule is used to target a requester based on the mechanism that they used to authenticate to the server. The value for this element can take one of the following forms:

The != operator can be used as an alternative to the =operator: authmethod!="simple". In that case, the bind rule matches if the client is not authenticated using the specified mechanism.

The ip bind rule can be used to target a requester based on the IP address of the client system. The value can be a comma-delimited list of any of the following IP address patterns:

The != operator can be used as an alternative to the “=” operator: ip!="1.2.3.0/24". In that case, the bind rule matches if the client does not match the given IP address pattern.

The dns bind rule can be used to target a requester based on a resolvable host name. The value can be a comma-delimited list of host names in either of the following forms:

The != operator can be used as an alternative to the = operator: dns!="*.example.com". In that case, the bind rule matches if the client host name does not match the provided pattern.

In general, we do not recommend using the dns bind rule. DNS might be vulnerable to spoofing attacks, which could help an attacker gain unauthorized access to the system. Further, if name resolution is slow (for example, as a result of a network problem or an intentional denial of service attack), then that can adversely affect the performance of the PingDirectory server.

The dayofweek bind rule is used to make access control decisions based on the current day of the week, as determined by the server’s current time zone. The value should be a comma-delimited list containing one or more of the following values: sun, mon, tue, wed, thu, fri, sat. For example, dayofweek="mon,tue,wed,thu,fri".

The != operator can be used as an alternative to the = operator: dayofweek!="sat,sun". In that case, the bind rule matches if the current day of the week is not included in the provided list.

The timeofday bind rule is used to make access control decisions based on the current time of the day, as determined by the server’s current time zone.

The value of this bind rule must be a four-digit number. The first two digits must represent the hour, with a value between 00 and 23. The last two digits must represent the minute, with a value between 00 and 59. For example, a value of 0123 represents a time of 1:23 a.m. in the server’s time zone.

The operator for this bind rule can be one of the following:

The oauthscope bind rule is used to make access control decisions based on the set of scopes associated with an OAuth 2.0 access token that the client used to authenticate.

This bind rule is primarily used for clients that have authenticated with the OAUTHBEARER SASL mechanism or for clients that have authenticated to Delegated Admin using an OAuth token. It does not currently apply to clients using SCIM or the Directory REST API even if they have authenticated with an OAuth token.

The value for this bind rule might have one of the following forms:

The != operator can be used as an alternative to the = operator: oauthscope!="admin_user". In that case, the bind rule matches if the user does not have the specified scope.