conditions

The <conditions> under which the <actions> of the enclosing <rule> are performed. The <conditions> are always specified in Conjunctive Normal Form (CNF) or Disjunctive Normal Form (DNF). As such the content of <conditions> is either a disjunction of conjunctions specified by a (possibly empty) set of <and>'s or a conjunction of disjunctions specified by a (possibly empty) set of <or>'s. The <actions> of the enclosing <rule> are only performed when the logical expression represented in CNF or DNF evaluates to TRUE or when no conditions are specified.

The evaluation of the conditions uses short circuit logic such that no additional tests are performed once it is possible to determine the resultant boolean value of the <conditions>.

All individual condition tests are represented by an element of the form <if-* op="some operator">.

Some condition tests have a mode parameter that indicates the algorithm to use for comparisons. The following table details the modes that are available.

mode	Description
case	Character by character case sensitive comparison.
nocase	Character by character case insensitive comparison.
regex	Regular expression match of entire string. Case insensitive by default, but may be changed by an escape in the expression. See http://java.sun.com/j2se/1.4/docs/api/java/util/regex/Pattern.html and http://java.sun.com/j2se/1.4/docs/api/java/util/regex/Matcher.html#matches(). Note that pattern option CASE_INSENSITIVE, DOTALL, and UNICODE_CASE are used but can be reversed using the appropriate embedded escapes.
src-dn	Compare using semantics appropriate to the DN format for the source datastore.
dest-dn	Compare using semantics appropriate to the DN format for the destination datastore.
numeric	Compare numerically.
octet	Compare octet (Base64 encoded) values.
structured	Compare structured attribute according to the comparison rules for the structured syntax of the attribute.

Example

See <policy>.