Overview[1]#

• NAME: Object ACL
• OID: 2.16.840.1.113719.1.1.5.1.17
• X-NDS_SYNTAX: 17

Every LDAP Entry in the NDS tree has an ACL (eDirectory Attribute). This attribute holds information about which trustees have access to the LDAP Entry itself (entry rights) and which trustees have access to the attributes for the entry. This information is stored in sets of information containing the following:

• The trustee name (subjectName)
• The affected attribute-Entry Rights, All Attributes Rights, or a specific attributeType (protectedAttrName)
• The privileges (privileges)

Required Access Privileges#

LDAP Format[1][2]#

<privileges> # <scope> # <subjectname> # <protectedattrname>

Remarks[1]#

You can match an ACL value against either a subject (trustee) or a privilege set, or both. If the subject name is not to be considered in the comparison, specify it as NULL. If the privilege set is not to be considered in the comparison, specify an “approximate match” with a privilege set value of zero.

The Object ACL syntax supports both matching for EQUALITY and APPROXIMATE matching. The difference between matching for equality and approximate matching concerns the privileges field of the comparison value.

When matching for EQUALITY, the privilege set must match exactly for the comparison to succeed.

When APPROXIMATE matching has been selected, any bits in the privilege field in the filter that are set must also be set in the target. Any other bits in the target are ignored.

Values with the same protectedAttrName and subjectName fields are considered to be duplicate, and so are not permitted.

For information on bit mask for the privileges field and on the special values available for protectedAttrName and subjectName fields, see the Object_ACL_T structure.

The number before the first # is in decimal. Convert the decimal value to hexadecimal (base 16) and select the privileges from the following table (starting with the largest value, or at the bottom):

eDirectory Privileges Field#

Entry level Permissions#

Attribute level Permissions#

Privilege for both Entries and Attrs#

Privilege for both Entries and Attributes example So in the case of:

ACL: 1073741863#subtree#cn=MyOrg,cn=User Management,cn=Role Based Service,ou=ENT,o=MyOrg#cn

The ACL value is 1073741863 (decimal) which converts to 40000027 hex (or 0x40000027). Starting at the bottom of the above table, this translates to:

• 0x40000000 = iManager Role Base Services granted privilege.
• 0x00000020 = Supervisor Permission to the attribute indicated (attr_supervisor)
• 0x00000004 = Write Permission to the attribute indicated (attr_write)
• 0x00000002 = Read Permission to the attribute indicated (attr_read)
• 0x00000001 = Compare Permission to the attribute indicated (attr_compare)

Scope Field#

Subjectname Field#

The Subjectname Field can also be one of the following special entry names:

• [Root] - used to grant rights to all authenticated entries.
• [Public] - used to grant rights to all entries in the eDirectory tree, even if the entry has not authenticated to the eDirectory tree.
• [Creator] - used to grant rights to the client that created the object.
• [Self] - used to allow objects to add or delete themselves as values of attributes.
• [Inheritance Mask] - used to mask or filter privileges granted to an object.

Referential Integrity is imposed on the Subjectname Field which identifies the EDirectory object referred to by the Field and must refer to a DN of an object that exists in the eDirectory tree. eDirectory verifies that this field refers to an existing object.

protectedAttrName field#

• [All Attributes Rights] - indicates that the rights apply to all the entry's attributes.
• [Entry Rights] - indicates that the rights apply to the entry that the ACL attribute is applied

API Data Structures#

typedef struct 
{
   pnstr8          protectedAttrName; 
   pnstr8          subjectName; 
   nuint32         privileges; 
} Object_ACL_T;

Transfer Format#

uint32     Length 
unicode    Name of Protected Attribute 
Align4 
unicode    Subject Name 
Align4 
uint32     Privileges

Binary#

ndsAcl ::= SEQUENCE {
   privileges          uint32,
   subjectName         LDAPDN,
   protectedAttrName   LDAPString
}

More Information#

• 2.16.840.1.113719.1.1.5.1.17
• ACL (eDirectory Attribute)
• NewObjectSDSRights
• NspmPasswordACL
• TrusteesOfNewObject
• X-NDS_ACL_TEMPLATES

• [#1] - Novell LDAP Library Documentation for Developers - based on information obtained 2013-04-10
• [#2] - LEX-Attribute Syntaxes - based on information obtained 2015-12-01
• [#3] - !!! What does the numeric value of ACL mean in an LDAP export? - based on information obtained 2021-05-13