Red Hat DIRECTORY SERVER 7.1, Administrator'S Manual

Page: 266 / 652

Viewing the ACIs for an Entry
266 Red Hat Directory Server Administrator’s Guide • May 2005
• user
specifies the account being checked, while
AuthId
checks the rights of the
AuthId
entry over the
user
entry.
•
control OID
is the OID for the get effective rights control,
1.3.6.1.4.1.42.2.27.9.5.2
.
•
boolean criticality
specifies whether the search operation should return an error
if the server does not support this control (
true
) or if it should be ignored and
let the search return as normal (
false
).
•
AuthId
is the DN of the entry whose rights over the
user
account are being
checked. If the
AuthId
is left blank (
dn:
), than the rights of an anonymous user
are returned.
A user, such as Ted Morris, can use this
ldapsearch
option to retrieve the rights
he has to his personal entry, as shown below. Along with returning the effective
rights information, the
ldapsearch
returns the regular entry information:
./ldapsearch -p 389 -h localhost -D
"uid=tmorris,ou=people,dc=example,dc=com" -w password -b
"uid=tmorris,ou=people,dc=example,dc=com" -J
"1.3.6.1.4.1.42.2.27.9.5.2:true:dn:
uid=tmorris,ou=people,dc=example,dc=com" "(objectClass=*)"
version: 1
dn: uid=tmorris, ou=People, dc=example,dc=com
givenName: Ted
sn: Morris
ou: Accounting
ou: People
l: Santa Clara
manager: uid=dmiller, ou=People, dc=example,dc=com
roomNumber: 4117
mail: tmorris@example.com
facsimileTelephoneNumber: +1 408 555 5409
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: tmorris
cn: Ted Morris
userPassword: {SSHA}bz0uCmHZM5b357zwrCUCJs1IOHtMD6yqPyhxBA==
entryLevelRights: v
attributeLevelRights: givenName:rsc, sn:rsc, ou:rsc, l:rsc,
manager:rsc, roomNumber:rscwo, mail:rscwo,
facsimileTelephoneNumber:rscwo, objectClass:rsc, uid:rsc,
cn:rsc, userPassword:wo