Novell EDIRECTORY 8.8 SP3, Administration Manual, Page: 61 / 634

Understanding Novell eDirectory 61
n
ov
do
cx (e
n)
11
Ju
ly 20
08
1.10.1 Trustee Assignments and Targets
The assignment of rights involves a trustee and a target object. The trustee represents the user or set
of users that are receiving the authority. The target represents those network resources the users have
authority over.
Š If you make an Alias a trustee, the rights apply only to the object the alias represents. The Alias
object can be an explicit target, however.
Š
A file or directory in the NetWare file system can also be a target, although file system rights
are stored in the file system itself, not in eDirectory.
NOTE: The [Public] trustee is not an object. It is a specialized trustee that represents any network
user, logged in or not, for rights assignment purposes.
[This] is a special type of trustee, that is defined to be an authenticated object, when its name
matches the entry being accessed. This helps the administrator to easily specify rights such as, every
user manages his own telephone number, with a single ACL at the top of the tree with [This] as a
trustee.
1.10.2 eDirectory Rights Concepts
The following concepts can help you better understand eDirectory rights.
Š
“Object (Entry) Rights” on page 61
Š
“Property Rights” on page 62
Š
“Effective Rights” on page 62
Š
“How Effective Rights Are Calculated” on page 62
Š
“Security Equivalence” on page 64
Š
“Access Control List (ACL)” on page 65
Š
“Inherited Rights Filter (IRF)” on page 65
Object (Entry) Rights
When you make a trustee assignment, you can grant object rights and property rights. Object rights
apply to manipulation of the entire object, while property rights apply only to certain object
properties. An object right is described as an entry right because it provides an entry into the
eDirectory database.
A description of each object right follows:
Š
Supervisor includes all rights to the object and all of its properties.
Š Browse lets the trustee see the object in the tree. It does not include the right to see an object’s
properties.
Š
Create applies only when the target object is a container. It allows the trustee to create new
objects below the container and also includes the Browse right.
Š
Delete lets the trustee delete the target from the directory.
Š Rename lets the trustee change the name of the target.