Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 174 / 578

Using Roles
174 Netscape Directory Server Administrator’s Guide • August 2002
Notice that the
nsManagedRoleDefinition
object class inherits from the
LDAPsubentry
,
nsRoleDefinition
and
nsSimpleRoleDefinition
object classes.
Assign the role to a marketing staff member named Bob by doing an
ldapmodify
as follows:
ldapmodify -D "cn=Directory Manager" -w secret -h host -p 389
dn: cn=Bob,ou=people,dc=example,dc=com
changetype: modify
add: nsRoleDN
nsRoleDN: cn=Marketing,ou=people,dc=example,dc=com
The
nsRoleDN
attribute present in the entry indicates that the entry is a member of
a managed role, the marketing managed role
cn=Marketing,ou=people,dc=example,dc=com
.
Example: Filtered Role Definition
You want to set up a filtered role for sales managers. Run the
ldapmodify
script as
follows:
ldapmodify -D "cn=Directory Manager" -w secret -h host -p 389
Specify the filtered role as follows:
dn: cn=SalesManagerFilter,ou=people,dc=example,dc=com
objectclass: top
objectclass: LDAPsubentry
objectclass: nsRoleDefinition
objectclass: nsComplexRoleDefinition
objectclass: nsFilteredRoleDefinition
cn: SalesManagerFilter
nsRoleFilter: o=sales managers
Description: filtered role for sales managers
Notice that the
nsFilteredRoleDefinition
object class inherits from the
LDAPsubentry
,
nsRoleDefinition
, and
nsComplexRoleDefinition
object
classes. The
nsRoleFilter
attribute specifies the
o
(organization) attributes that
contain the value of
sales managers
.
The following entry matches the filter (possesses the
o
attribute with the value
sales manager
) and therefore is a member of this filtered role:
dn: cn=Pat,ou=people,dc=example,dc=com
objectclass: person
cn: Pat
sn: Pat
userPassword: bigsecret
o: sales managers