• member attribute (is: | is not:) the name clause plus one or more value clauses below in a semicolon-separated list:
  • name (is | exists | not exists) literal attribute name
  • value (is | is not) literal value string
  • value (like | not like) value wildcard expression
  • value (matches | not matches) value regular expression
  • value (has keyword | lacks keyword) literal keyword string

Purpose

member attribute lets you check for the existence of an attribute (regardless of that attribute's value) (exists/not exists) or check attribute/value pairs (all of the other value requirement choices).

Notes

All attribute values are strings (even the values that contain only numbers), therefore there are no numeric comparison operators (<, >, etc.). Each requirement can contain one name and one or more value properties; Martinet will generate a warning only if the entire requirement fails to match any attribute/value pair for the specified group members.

To test for an attribute name's existence without checking its value, use name exists literal attribute name. Similarly, testing for an attribute's absence, use name not exists literal attribute name.

Any test for an attribute's value implies checking for that attribute's existence, so:

member attribute is: name is uiucEduType; value lacks keyword retired

(which will warn when retirees are members of the listed groups) implies that the uiucEduType attribute exists — there is no need to add name exists uiucEduType. In other words, If an examined AD object doesn't have the uiucEduType attribute, or if that attribute's value doesn't contain the keyword retired, this requirement will fail and raise a warning.

If the value you are matching against contains a semicolon, quote the value:

# Matching a value ending in a semicolon literally.
member attribute is: name is attributeExample; value is "valueExampleWithEndingSemicolon;"
# Matching a value ending in a semicolon with a wildcard expression.
member attribute is: name is attributeExample; value like "valueExampleWithEndingSemicolon;"
# Matching a value ending in a semicolon with a regular expression.
member attribute is: name is attributeExample; value matches "valueExampleWithEndingSemicolon;"

Examples

# The distinguishedName attribute exists (regardless of its value).
member attribute is: name is distinguishedName

# The distinguishedName attribute exists and holds a value matching
# regular expression /CN=[^,]+,OU=People,DC=ad,DC=uillinois,DC=edu$/.
#
# This is how you check for non-University-issued user members in a group.
member attribute is: name is distinguishedName; value matches CN=[^,]+,OU=People,DC=ad,DC=uillinois,DC=edu$

Example configuration

# The uiucEduType attribute exists and holds a value matching a
# regular expression which looks for keywords.
#
# This is how you check for University-issued user members who have retired. Typically, one does not want
# retirees as members of their AD groups which contain AD user accounts (such as staff groups).
member attribute is: name is uiucEduType; value lacks keyword retired

Example output