Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 236 / 578

Access Control Usage Examples
236 Netscape Directory Server Administrator’s Guide • August 2002
This example assumes that the
aci
is added to the
dc=example,dc=com entry
.
Note that the userPassword attribute is excluded from the scope of the ACI.
From the Console, you can set this permission by doing the following:
1.
On the Directory tab, right click the
example.com
node in the left navigation
tree, and choose Set Access Permissions from the pop-up menu to display the
Access Control Manager.
2.
Click New to display the Access Control Editor.
3.
On the Users/Groups tab, in the ACI name field, type "
Anonymous
example.com
". Check that All Users is displayed in the list of users granted
access permission.
4.
On the Rights tab, tick the checkboxes for read, compare, and search rights.
Make sure the other checkboxes are clear.
5.
On the Targets tab, click This Entry to display the
dc=example,dc=com
suffix
in the target directory entry field. In the attribute table, locate the
userPassword
attribute and clear the corresponding checkbox.
All other checkboxes should be ticked. This task is made easier if you click the
Name header to organize the list of attributes alphabetically.
6.
On the Hosts tab, click Add, and in the DNS host filter field, type
*.example.com
. Click OK to dismiss the dialog box.
7.
Click OK in the Access Control Editor window.
The new ACI is added to the ones listed in the Access Control Manager
window.
ACI “Anonymous World”
In LDIF, to grant read and search access of the individual subscribers subtree to the
world, while denying access to information on unlisted subscribers, you could
write the following statement:
aci: (targetfilter= "(!(unlistedSubscriber=yes))")
(targetattr="homePostalAddress || homePhone || mail") (version 3.0;
acl "Anonymous World"; allow (read, search) userdn=
"ldap:///anyone";)