Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 241 / 578

Access Control Usage Examples
Chapter 6 Managing Access Control 241
Restricting Access to Key Roles
You can use role definitions in the directory to identify functions that are critical to
your business, the administration of your network and directory, or another
purpose.
For example, you might create a
superAdmin
role by identifying a subset of your
system administrators that are available at a particular time of day and day of the
week at corporate sites worldwide. Or you might want to create a
First Aid
role
that includes all members of staff on a particular site that have done first aid
training. For information on creating role definitions, refer to “Using Roles,” on
page 166.
When a role gives any sort of privileged user rights over critical corporate or
business functions, you should consider restricting access to that role. For example,
at
example.com
, employees can add any role to their own entry, except the
superAdmin
role. This is illustrated in the ACI “Roles” example.
ACI “Roles”
In LDIF, to grant
example.com
employees the right to add any role to their own
entry, except the
superAdmin
role, you would write the following statement:
aci: (targetattr = "nsRoleDn")
(targattrfilters="add=nsRoleDN:(nsRoleDN !=
"cn=superAdmin,dc=example,dc=com")") (version 3.0; acl "Roles";
allow (write) userdn= "ldap:///self" and dns="*.example.com";)
This example assumes that the ACI is added to the
ou=example-people,dc=example,dc=com
entry.
From the Console, you can set this permission by doing the following:
1.
On the Directory tab, right click the
example.com
node in the left navigation
tree, and choose Set Access Permissions from the pop-up menu to display the
Access Control Manager.
2.
Click New to display the Access Control Editor.
3.
On the Users/Groups tab, in the ACI name field, type "Roles". In the list of
users granted access permission, do the following:
a.
Select and remove All Users, then click Add.
The Add Users and Groups dialog box is displayed.
b.
Set the Search area in the Add Users and Groups dialog box to to Special
Rights, and select Self from the Search results list.