Novell EDIRECTORY 8.8 - GUIDE, Manual

Page: 59 / 574

Understanding Novell eDirectory 59
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
f. eDirectory adds any noninheritable rights assigned at the target resource, overriding as
needed.
eDirectory uses the same process as in Step 2d above. The resulting set of rights
constitutes the effective rights for this trustee.
3. eDirectory combines the effective rights of all the trustees in the list as follows:
a. eDirectory includes every right held by any trustee in the list and excludes only those
rights that are missing from every trustee in the list. eDirectory does not mix right types.
For example, it does not add rights for a specific property to rights for all properties or
vice versa.
b. eDirectory adds rights that are implied by any of the current effective rights.
The resulting set of rights constitutes the user’s effective rights to the target resource.
Example
User DJones is attempting to access volume Acctg_Vol. (See Figure 1-20 .)
Figure 1-20
Sample Trustee Rights
The following process shows how eDirectory calculates DJones’ effective rights to Acctg_Vol:
1. The trustees whose rights are to be considered in the calculation are DJones, Marketing, Tree,
and [Public].
This assumes that DJones doesn’t belong to any groups or roles and has not been explicitly
assigned any security equivalences.
2. The effective rights for each trustee are as follows:
• DJones: Zero object, zero all properties
The assignment of zero all property rights at Acctg_Vol overrides the assignment of Write
all properties at Accounting.
• Marketing: Zero all properties
The assignment of Write all properties at the top of the tree is filtered out by the IRF at
Accounting.
• Tree: No rights
No rights are assigned for Tree anywhere in the pertinent branch of the tree.
• [Public]: Browse object, Read all properties
ACL
[Public] Browse object
(inheritable) [Public] Read
all prop (inheritable)
ACL
IRF Write all prop (n/a)
DJones Write all prop
ACL
DJones zero object
(inheritable) DJones
zero