LDAP-UX Client Services B.05.00 with Microsoft Windows Active Directory Server Administrator's Guide (obsolete beyond B.05.00)

These fields have the following limitations:
• No leading or trailing empty space is allowed in a field
• Fields are separated by a separator, :
• No leading or trailing empty space is allowed in a separator
• An access rule is terminated by a carriage return
6.4.7.1 Fields in an access rule
Table 8 shows a summary on all possible values and syntax of an access rule:
Table 8 Field syntax in an access rule
<object><type><action>
A list of user name. It can be the multi-valued field. Each
value is a character string that is separated by a separator
"," (ASCII 2C HEX).
Example:
user1, user2, user3
unix_userdeny, allow,required,
<pam_code>
No value is required.unix_local_userdeny, allow, required,
<pam_code>
A list of group name. It can be the multi-valued field. Each
value is a character string that is separated by a separator
"," (ASCII 2C HEX).
Example:
group1, group2, group3
unix_groupdeny, allow, required,
<pam_code>
No value is required.passwd_compatrequired, <pam_code>
A list of netgroup name. It can be the multi-valued field.
Each value is a character string that is separated by a
separator ","(ASCII 2C HEX).
Example:
netgroup1, netgroup2, netgroup3
netgroupdeny, allow, required,
<pam_code>
It is the Distinguished name of a ldap group with
groupofnames objectclass or groupofuniquenames
objectclass. It is a single-valued field. No separator is
required. The syntax of DN is defined in RFC2253.
Example:
cn=ldapgroup1,cn=groups,dc=mydomain,dc=com
ldap_groupdeny, allow, required,
<pam_code>
It is a single search descriptor that specifies one or more
(attribute=value) or (attribute=$[variable_name]) pairs.
$[variable_name] is a dynamic variable. It is a single
value field. Only one search filter is allowed. No
separator is required. The syntax of DN is defined in
RFC2254.
Example:
(&(manager=Joeh)(department=sales)(hostcontrol=$[HOSTNAME]))
ldap_filterdeny, allow, required,
<pam_code>
6.4 PAM_AUTHZ login authorization 103