Netscape NETSCAPE DIRECTORY SERVER 6.02, Administrator'S Manual

Page: 192 / 568

Access Control Principles
192 Netscape Directory Server Administrator’s Guide • May 2002
For example, if you deny write permission at the directory’s root level, then none of
the users can write to the directory regardless of the specific permissions you grant
them. To grant a specific user write permissions to the directory, you have to
restrict the scope of the original denial for write permission so that it does not
include the user.
ACI Limitations
When creating an access control policy for your directory service, you need to be
aware of the following restrictions:
• If your directory tree is distributed over several servers using the chaining
feature, some restrictions apply to the keywords you can use in access control
statements:
❍
ACIs that depend on group entries (
groupdn
keyword) must be located on
the same server as the group entry. If the group is dynamic, then all
members of the group must have an entry on the server too. If the group is
static, the members’s entries can be located on remote servers.
❍
ACIs that depend on role definitions (
roledn
keyword) must be located on
the same server as the role definition entry. Every entry that is intended to
have the role must also be located on the same server.
However, you can do value matching of values stored in the target entry with
values stored in the entry of the bind user (for example, using the userattr
keyword). Access will be evaluated normally even if the bind user does not
have an entry on server that holds the ACI.
For more information on how to chain access control evaluation, see “Database
Links and Access Control Evaluation,” on page 111.
• Attributes generated by a CoS cannot be used in all ACI keywords.Specifically,
you should not use attributes generated by CoS with the following keywords:
❍
targetfilter
(see “Targeting Entries or Attributes Using LDAP Filters,”
on page 199)
❍
targattrfilters
(see “Targeting Attribute Values Using LDAP Filters,”
on page 200)
❍
userattr
(see “Using the userattr Keyword,” on page 214)
If you create target filters or bind rules that depend on the value of attributes
generated by CoS, the access control rule will not work. For more information
on CoS, see Chapter 5, “Advanced Entry Management.”