Red Hat DIRECTORY SERVER 7.1, Administrator'S Manual, Page: 263 / 652

Viewing the ACIs for an Entry
Chapter 6 Managing Access Control 263
In the above example, if the client wanted to perform an
ldapsearch
command,
the command would include the following controls:
#ldapmodify -D "uid=MoneyWizAcctSoftware,
ou=Applications,dc=example,dc=com" -w secretpwd
-y "uid=AcctAdministrator,ou=Administrators,dc=example,dc=com"
The client or application (
MoneyWizAcctSoftware
) binds as itself but is granted the
privileges of the proxy entry (
AcctAdministrator
). The client does not need the
password of the proxy entry.
Viewing the ACIs for an Entry
You can view all the ACIs under a single suffix in the directory by running the
following
ldapsearch
command:
ldapsearch -h
host
-p
port
-b
baseDN
-D
rootDN
-w
rootPassword
(aci=*)
aci
See Red Hat Directory Server Configuration, Command, and File Reference for
information on using the
ldapsearch
utility.
From the Console, you can view all of the ACIs that apply to a particular entry
through the Access Control Manager.
1.
In the Directory Console, on the Directory tab, right-click the entry in the
navigation tree, and select Set Access Permissions.
The Access Control Manager is displayed. It contains a list of the ACIs
belonging to the selected entry.
2.
Check the Show Inherited ACIs checkbox to display all ACIs created on entries
above the selected entry that also apply.
Get Effective Rights Control
Finding the rights on existing attributes within a specific entry offers a convenient
way for administrators to find and control the access rights.
NOTE You cannot use the directory manager’s DN (Root DN) as a proxy
DN. In addition, if Directory Server receives more than one proxied
authentication control, an error is returned to the client application,
and the bind attempt is unsuccessful.