The <conditions> under which the <actions> of the enclosing <rule> are performed. The <conditions> are always specified in Conjunctive Normal Form (CNF) or Disjunctive Normal Form (DNF). As such the content of <conditions> is either a disjunction of conjunctions specified by a (possibly empty) set of <and>'s or a conjunction of disjunctions specified by a (possibly empty) set of <or>'s. The <actions> of the enclosing <rule> are only performed when the logical expression represented in CNF or DNF evaluates to TRUE or when no conditions are specified.
The evaluation of the conditions uses short circuit logic such that no additional tests are performed once it is possible to determine the resultant boolean value of the <conditions>.
All individual condition tests are represented by an element of the form <if-* op="some operator">.
Some condition tests have a mode parameter that indicates the algorithm to use for comparisons. The following table details the modes that are available.
Character by character case sensitive comparison.
Character by character case insensitive comparison.
Regular expression match of entire string. Case insensitive by default, but may be changed by an escape in the expression.
Note that pattern option CASE_INSENSITIVE, DOTALL, and UNICODE_CASE are used but can be reversed using the appropriate embedded escapes.
Compare using semantics appropriate to the DN format for the source datastore.
Compare using semantics appropriate to the DN format for the destination datastore.
Compare octet (Base64 encoded) values.
Compare structured attribute according to the comparison rules for the structured syntax of the attribute.
- logical conjunction
- logical disjunction
- rule within a policy
Top Elements || All Elements || Tree