5.1.4. How ACI is Evaluated

Understanding how OpenDJ evaluates the aci values is critical when implementing an access control policy. The rules the server follows are simple.

  1. To determine if an operation is allowed or denied, the OpenDJ server looks in the directory for the target of the operation. It collects any aci values from that entry, and then walks up the directory tree to the suffix, collecting all aci values en route. Global aci values are then collected.

  2. It then separates the aci values into two lists; one list contains all the aci values that matches the target and denies the required access, and the other list contains all the aci values that matches the target and allows the required access.

  3. If the deny list contains any aci values after this procedure, access will be immediately denied.

  4. If the deny list is empty, then the allow list is processed. If the allow list contains any aci values, access will be allowed.

  5. If both lists are empty, access will be denied.

[Note] Note

Some operations require multiple permissions and involve multiple targets. Evaluation will therefore take place multiple times. For example a search operation requires the search permission for each attribute in the search filter. If all those are allowed, the read permission is used to decide what attributes and values can be returned.