Netscape NETSCAPE DIRECTORY SERVER 6.02, Administrator'S Manual

Page: 246 / 568

Access Control Usage Examples
246 Netscape Directory Server Administrator’s Guide • May 2002
7.
Click OK.
The new ACI is added to the ones listed in the Access Control Manager
window.
Setting a Target Using Filtering
If you want to set access controls that allow access to a number of entries that are
spread across the directory, you may want to use a filter to set the target. Keep in
mind that because search filters do not directly name the object for which you are
managing access, it is easy to unintentionally allow or deny access to the wrong
objects, especially as your directory becomes more complex. Additionally, filters
can make it difficult for you to troubleshoot access control problems within your
directory.
The following procedure shows you how to grant user
bjensen
write access to the
department number, home phone number, home postal address, JPEG photo, and
manager attributes for all members of the accounting organization.
Before you can set these permissions, you must create the accounting branch point
(
ou=accounting,dc=example,dc=com
). You can create organizational unit branch
points using the directory tab on the Directory Server Console.
Allowing Users to Add or Remove Themselves From a Group
Many directories set ACIs that allow users to add or remove themselves from
groups. This is useful, for example, for allowing users to add and remove
themselves from mailing lists.
At
example.com
, employees can add themselves to any group entry under the
ou=social committee
subtree. This is illustrated in the ACI “Group Members”
example.
ACI “Group Members”
In LDIF, to grant
example.com
employees the right to add or delete themselves
from a group, you would write the following statement:
aci: (targettattr="member")(version 3.0; acl "Group Members";
allow (selfwrite)
(userdn= "ldap:///uid=*,ou=example-people,dc=example,dc=com") ;)
This example assumes that the ACI is added to the
ou=social committee,
dc=example,dc=com
entry.