Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 253 / 578

Access Control Usage Examples
Chapter 6 Managing Access Control 253
Proxied Authorization ACI Example
For this example, suppose:
• The client application’s bind DN is
"uid=MoneyWizAcctSoftware,
ou=Applications,dc=example,dc=com"
.
• The targeted subtree to which the client application is requesting access is
ou=Accounting,dc=example,dc=com
.
• An Accounting Administrator with access permissions to the
ou=Accounting,dc=example,dc=com
subtree exists in the directory.
In order for the client application to gain access to the Accounting subtree (using
the same access permissions as the Accounting Administrator):
• The Accounting Administrator must have access permissions to the
ou=Accounting,dc=example,dc=com
subtree. For example, the following ACI
grants all rights to the Accounting Administrator entry:
aci: (target="ldap:///ou=Accounting,dc=example,dc=com")
(targetattr="*") (version 3.0; acl "allowAll-AcctAdmin"; allow (all)
userdn="ldap://uid=AcctAdministrator,ou=Administrators,dc=example,
dc=com")
• The following ACI granting proxy rights to the client application must exist in
the directory:
aci: (target="ldap:///ou=Accounting,dc=example,dc=com")
(targetattr="*") (version 3.0; acl "allowproxy-accountingsoftware";
allow (proxy)
userdn="ldap://uid=MoneyWizAcctSoftware,ou=Applications,dc=example,
dc=com")
With this ACI in place, the
MoneyWizAcctSoftware
client application can bind to
the directory and send an LDAP command such as
ldapsearch
or
ldapmodify
that requires the access rights of the proxy DN.
In the above example, if the client wanted to perform an
ldapsearch
command,
the command would include the following controls:
#ldapmodify -D "uid=MoneyWizAcctSoftware,
ou=Applications,dc=example,dc=com" -w secretpwd
-y "uid=AcctAdministrator,ou=Administrators,dc=example,dc=com"
Note that the client or application (
MoneyWizAcctSoftware
) binds as itself, but is
granted the privileges of the proxy entry (
AcctAdministartor
). The client does not
need the password of the proxy entry.