---
name: "Wallet::ACL::LDAP::Attribute"
section: "3pm"
platform: "linux"
package: "krb5-wallet-server"
version: "1.7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/Wallet::ACL::LDAP::Attribute"
---

# Wallet::ACL::LDAP::Attribute(3pm)

Wallet ACL verifier for LDAP attribute compares

## NAME

Wallet::ACL::LDAP::Attribute - Wallet ACL verifier for LDAP attribute compares

## SYNOPSIS

```
    my $verifier = Wallet::ACL::LDAP::Attribute->new;
    my $status = $verifier->check ($principal, "$attr=$value");
    if (not defined $status) {
        die "Something failed: ", $verifier->error, "\n";
    } elsif ($status) {
        print "Access granted\n";
    } else {
        print "Access denied\n";
    }
```

## DESCRIPTION

Wallet::ACL::LDAP::Attribute checks whether the LDAP record for the entry corresponding to a principal contains an attribute with a particular value.  It is used to verify ACL lines of type `"ldap-attr"`.  The value of such an ACL is a valid LDAP filter, and the ACL grants access to a given principal if and only if an LDAP search using a filter constructed of the principal filter AND  the ACL filter returns a single entry.

To use this object, several configuration parameters must be set.  See Wallet::Config for details on those configuration parameters and information about how to set wallet configuration.

## METHODS

- **new()**

  Creates a new ACL verifier.  Opens and binds the connection to the LDAP server.

- check(PRINCIPAL, ACL)

  Returns true if PRINCIPAL is granted access according to ACL, false if not, and undef on an error (see "DIAGNOSTICS" below).  ACL must be a valid LDAP filter.  The filter formed using the PRINCIPAL and the ACL filter must return a single entry for access to be granted.

- **error()**

  Returns the error if **check()** returned undef.

## DIAGNOSTICS

The **new()** method may fail with one of the following exceptions:

- LDAP attribute ACL support not available: %s

  Attempting to connect or bind to the LDAP server failed.

- LDAP attribute ACL support not configured

  The required configuration parameters were not set.  See **Wallet::Config**(3) for the required configuration parameters and how to set them.

Verifying an LDAP attribute ACL may fail with the following errors (returned by the **error()** method):

- search for %s failed in LDAP: %s

  The search for an ldap entry failed because of a configuration error in Wallet or the LDAP server.  For example the Wallet configuration includes an invalid root DN.

- malformed ldap-attr LDAP filter, no equal sign present

  The ACL filter stored as ldap-attr is not a valid LDAP filter.

- malformed ldap-attr LDAP filter, parenthesis mismatch

  The ACL filter stored as ldap-attr is not a valid LDAP filter.

- mapping principal to LDAP failed: %s

  There was an **ldap\_map\_principal()** function defined in the wallet configuration, but calling it for the PRINCIPAL argument failed.

- no ACL specified

  The ACL parameter to **check()** was undefined or the empty string.

- no principal specified

  The PRINCIPAL parameter to **check()** was undefined or the empty string.

## SEE ALSO

**Wallet::ACL**(3), **Wallet::ACL::Base**(3), **Wallet::Config**(3), [**wallet-backend**(8)](/wallet-backend/8.md)

This module is part of the wallet system.  The current version is available from \<https://www.eyrie.org/~eagle/software/wallet/\>.

## AUTHOR

Russ Allbery \<eagle@eyrie.org\>