Novell EDIRECTORY 8.8 - GUIDE, Manual, Page: 60 / 574

60 Novell eDirectory 8.8 Administration Guide
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
These rights are assigned at the root and aren’t filtered or overridden anywhere in the
pertinent branch of the tree.
3. Combining the rights from all these trustees results in the following:
DJones: Browse object, Read all properties
4. Adding the Compare all properties right that is implied by the Read all properties right, DJones
has the following final effective rights to Acctg_Vol:
DJones: Browse object, Read and Compare all properties
Blocking Effective Rights
Because of the way that effective rights are calculated, it is not always obvious how to block
particular rights from being effective for specific users without resorting to an IRF (an IRF blocks
rights for all users).
To block particular rights from being effective for a user without using an IRF, do either of the
following:
• Ensure that neither the user nor any of the objects that the user is security equivalent to ever
gets assigned those rights, either at the target resource or at any level above the target resource
in the tree.
• If the user or any object that the user is security equivalent to does get assigned those rights,
ensure that that object also has an assignment lower in the tree that omits those rights. Do this
for every trustee (associated with the user) that has the unwanted rights.
Security Equivalence
Security equivalence means having the same rights as another object. When you make one object
security equivalent to another object, the rights of the second object are added to the rights of the
first object when the system calculates the first object's effective rights.
For example, suppose you make User object Joe security equivalent to the Admin object. After you
create the security equivalence, Joe has the same rights to the tree and file system as Admin.
There are three types of security equivalence:
• Explicit: By assignment
• Automatic: By membership in a group or role
• Implied: Equivalent to all parent containers and the [Public] trustee
Security equivalence is effective only for one step. For example, if you make a third user security
equivalent to Joe in the example above, that user does not receive Admin rights.
Security equivalence is recorded in eDirectory as values in the User object’s Security Equal To
property.
When you add a User object as an occupant to an Organizational Role object, that User
automatically becomes security equivalent to the Organizational Role object. The same is true when
a User becomes a member of a Group role object.