The <conditions> under which the <actions> of the enclosing <rule> are performed. The <conditions> are always specified in Conjunctive Normal Form (CNF) or Disjunctive Normal Form (DNF). As such the content of <conditions> is either a disjunction of conjunctions specified by a (possibly empty) set of <and>'s or a conjunction of disjunctions specified by a (possibly empty) set of <or>'s. The <actions> of the enclosing <rule> are only performed when the logical expression represented in CNF or DNF evaluates to TRUE or when no conditions are specified.

The evaluation of the conditions uses short circuit logic such that no additional tests are performed once it is possible to determine the resultant boolean value of the <conditions>.

All individual condition tests are represented by an element of the form <if-* op="some operator">.

Some condition tests have a mode parameter that indicates the algorithm to use for comparisons. The following table details the modes that are available.

mode Description


Character by character case sensitive comparison.


Character by character case insensitive comparison.


Regular expression match of entire string. Case insensitive by default, but may be changed by an escape in the expression.

See and

Note that pattern option CASE_INSENSITIVE, DOTALL, and UNICODE_CASE are used but can be reversed using the appropriate embedded escapes.


Compare using semantics appropriate to the DN format for the source datastore.


Compare using semantics appropriate to the DN format for the destination datastore.


Compare numerically.


Compare octet (Base64 encoded) values.


Compare structured attribute according to the comparison rules for the structured syntax of the attribute.


See <policy>.

1. Allowed Content

logical conjunction
logical disjunction

2. No Attributes

3. Content Rule

( and * | or * )

4. Parent Elements

  rule within a policy

Top Elements || All Elements || Tree

DirXMLScript DTD