Red Hat DIRECTORY SERVER 7.1, Administrator'S Manual, Page: 255 / 652

Access Control Usage Examples
Chapter 6 Managing Access Control 255
Granting Conditional Access to a Group or Role
In many cases, when you grant a group or role privileged access to the directory,
you want to ensure that those privileges are protected from intruders trying to
impersonate your privileged users. Therefore, in many cases, access control rules
that grant critical access to a group or role are often associated with a number of
conditions.
example.com
, for example, has created a Directory Administrator role for each of
its hosted companies,
HostedCompany1
and
HostedCompany2
. It wants these
companies to be able to manage their own data and implement their own access
control rules while securing it against intruders. For this reason,
HostedCompany1
and
HostedCompany2
have full rights on their respective branches of the directory
tree, provided the following conditions are fulfilled:
• Connection authenticated using SSL,
• Access requested between 8 a.m. and 6 p.m., Monday through Thursday, and
• Access requested from a specified IP address for each company.
These conditions are illustrated in a single ACI for each company, ACI
“HostedCompany1” and ACI “HostedCompany2.” Because the content of these
ACIs is the same, the examples below illustrate the “HostedCompany1” ACI only.
ACI “HostedCompany1”
In LDIF, to grant HostedCompany1 full access to their own branch of the directory
under the conditions stated above, you would write the following statement:
aci:
(target="ou=HostedCompany1,ou=corporate-clients,dc=example,dc=co
m")
(targetattr= "*") (version 3.0; acl "HostedCompany1";
allow (all)
(roledn="ldap:///cn=DirectoryAdmin,ou=HostedCompany1,
ou=corporate-clients, dc=example,dc=com") and (authmethod="ssl")
and
(dayofweek="Mon,Tues,Wed,Thu") and (timeofday >= "0800" and
timeofday <= "1800") and (ip="255.255.123.234"); )
This example assumes that the ACI is added to the
ou=HostedCompany1,
ou=corporate-clients,dc=example,dc=com
entry.
From the Console, you can set this permission by doing the following: