Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 127 / 578

Creating and Maintaining Database Links
Chapter 3 Configuring Directory Databases 127
Creating the Proxy Administrative User ACI
You need to create an ACI on the server that contains the intermediate database
link that checks the rights of the first database link before translating the request to
another server. For example, if server two does not check the credentials of server
one, then anyone could bind as anonymous and pass a proxy authorization control
allowing them more administrative privileges than appropriate.
To prevent this security hole, you need to create an ACI on the server which
contains the intermediate database link. To create an ACI, you need to do the
following:
1.
Create a database, if one does not already exist, on the server containing the
intermediate database link. This database will contain the admin user entry
and the ACI. For information about creating a database, see “Creating
Databases,” on page 90.
2.
Create an entry that corresponds to the administrative user in the database.
3.
Create an ACI for the administrative user that targets the appropriate suffix.
This ensures the administrator has access only to the suffix of the database link.
Add the following ACI to the administrative user’s entry:
aci: (targetattr = "*")(version 3.0; acl "Proxied authorization
for database links"; allow (proxy) userdn = "ldap:///cn=proxy
admin,cn=config";)
This ACI is like the ACI you create on the remote server when configuring
simple chaining.
Enabling Local ACI Evaluation
To confirm that the proxy administrative ACI is used, you need to enable
evaluation of local ACIs on all intermediate database links involved in chaining. To
do this, add the following attribute to the
cn=
database_link_name
,cn=chaining
database,cn=plugins,cn=config
entry of each intermediate database link:
nsCheckLocalACI: on
CAUTION Carefully examine access controls when enabling chaining to avoid
giving access to restricted areas of your directory. For example, if
you create a default proxy ACI on a branch, the users that connect
via the database link will be able to see all entries below the branch.
There may be cases when you do not want all of the subtrees to be
viewed by a user. To avoid a security hole, you may need to create
an additional ACI to restrict access to the subtree.