target keyword indicates that the ACI should apply to one or more
entries at or below the specified distinguished name (DN).
The target DN must be equal or subordinate to the DN of the entry in which the ACI is placed. For example, if you place the ACI at the root of ou=People,dc=example,dc=com, you can target the DN, uid=user.1,ou=People,dc=example,dc=com, within your ACI rule. The DN must meet the string representation specification of distinguished names, outlined in RFC 4514, and requires that special characters be properly escaped.
target clause has the following format, where DN
is the distinguished name of the entry or branch:
(target = ldap:///<DN>)
For example, to target a specific entry, use a clause like the following.
(target = ldap:///uid=john.doe,ou=People,dc=example,dc=com)
In most cases, you should avoid specifying a target DN. Instead, define the ACI in
that entry and omit the
target element altogether.
For example, although you can have
(target="ldap:///uid=john.doe,ou=People,dc=example,dc=com) in any
ou=People entries, you
should define it in the
uid=john.doe entry and not explicitly
The expression allows for the not equal operator (
!=) to indicate that
all entries within the scope of the given branch that do not match the expression be
targeted for the ACI. The following expression targets all entries within the subtree
that do not match
(target != ldap:///uid=john.doe,ou=People,dc=example,dc=com)
target keyword also supports the use of asterisk
*) characters as wildcards to match elements within the
- The following target expression matches all entries that contain and begin with
(target = ldap:///uid=john.d*,ou=People,dc=example,dc=com)
Entries such as
john.davies,ou=People,dc=example,dc=comwould match the target expression.
- The following target expression matches all entries whose DN begins with
john.dand matches the
(target = ldap:///uid=john.d*,ou=*,dc=example,dc=com)
Entries such as
john.davies,ou=asia-branch,dc=example,dc=comwould match the target expression.
Another example of a complete ACI targets the entries in the ou=People,dc=example,dc=com branch and the entries below it and grants the users the privilege to modify all of their user attributes within their own entries.
aci:(target="ldap:///ou=People,dc=example,dc=com") (targetattr="*") (version 3.0; acl "Allow all the ou=People branch to modify their own entries"; allow (write) userdn="ldap:///self";)