Novell EDIRECTORY 8.8 - GUIDE, Manual, Page: 101 / 574

Managing Objects 101
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
3.3 Configuring Role-Based Services
Novell iManager gives administrators the ability to assign specific responsibilities to users and to
present the user with only the tools (and their accompanying rights) necessary to perform those sets
of responsibilities. This functionality is called
Role-Based Services (RBS).
Role-Based Services allows administrators to focus the user on a specified set of functions, called
tasks , and objects as determined by the grouping of tasks called roles . What users see when they
access iManager is based on their role assignments in eDirectory. Only the tasks assigned to that
user are displayed. The user does not need to browse the tree to find an object to administer; the
iManager plug-in for that task presents the necessary tools and interface to perform the task.
You can assign multiple roles to a single user. You can also assign the same role to multiple users.
Role-Based Services is represented by objects defined in eDirectory. The base eDirectory schema
gets extended during the iManager installation. The RBS object types are listed in the following
table.
Object Description
rbsCollection A container object that holds all RBS Role and Module objects.
rbsCollection objects are the topmost containers for all RBS objects. A
tree can have any number of rbsCollection objects. These objects have
“owners,” which are users who have management rights over the
collection.
rbsCollection objects can be created in any of the following containers:
• Country
• Domain
• Locality
• Organization
• Organizational Unit
rbsRole A container object that specifies the tasks that users (members) are
authorized to perform. Defining a role includes creating an rbsRole object
and specifying the tasks that the role can perform.
Role members can be Users, Groups, Organizations, or Organizational
Units, and they are associated to a role in a specific scope of the tree.
The rbsTask and rbsBook objects are assigned to rbsRole objects.
rbsRole objects can be created only in rbsCollection containers.
rbsModule A container object that holds rbsTask and rbsBook objects. rbsModule
objects have a module name attribute that represents the name of the
product that defines the tasks or books (for example, eDirectory
Maintenance Utilities, NMAS Management, or Novell Certificate Server
Access).
rbsModule objects can be created only in rbsCollection containers.
rbsTask A leaf object that represents a specific function, such as resetting login
passwords.
rbsTask objects are located only in rbsModule containers.