Red Hat DIRECTORY SERVER 8.0, Administration Manual

Page: 136 / 552

Chapter 5. Managing Entries with Roles, Classes of Service, and Views
118
Table 5.1, “Object Classes and Attributes for Roles”
lists the object classes and attributes associated
with each type of role.
Role Type Object Classes Attributes
Managed Role nsSimpleRoleDefinition
nsManagedRoleDefinition description (optional)
Filtered Role nsComplexRoleDefinition
nsFilteredRoleDefinition nsRoleFilter
Description (optional)
Nested Role nsComplexRoleDefinition
nsNestedRoleDefinition nsRoleDN
Description (optional)
Table 5.1. Object Classes and Attributes for Roles
The attributes
nsRole
and
nsRoleDN
are operational attributes. This means that they are not present
in the schema of the entry and may be added to any entry, regardless of schema. This also means
that these attributes must be explicitly requested in the search attributes list in search requests. For
example, this
ldapsearch
command lists all of the roles (values of
nsRole
), all of the managed
roles (values of
nsRoleDN
), and all of the regular attributes in the entry matched by
uid=scarter
.
ldapsearch ... args ... “(uid=scarter)” \* nsRole nsRoleDN
Similarly for the role definition entries, they are operational entries and are not returned by default with
regular searches. This means that if roles are defined under the
ou=People,dc=example,dc=com
subtree, for example, the following
ldapsearch
command will not return the role definitions for any
entry:
ldapsearch -s sub -b ou=People,dc=example,dc=com “(objectclass=*)”
To see the role definitions entries, use the special search filter
"(objectclass=ldapSubEntry)"
with
ldapsearch
. The special filter can be added to any other
search filter, using OR (|):
ldapsearch -s sub -b ou=People,dc=example,dc=com “(|(objectclass=*)
(objectclass=ldapSubEntry))”
This search shows all regular entries in addition to role definition entries in the
ou=People,dc=example,dc=com
subtree. The Console automatically shows all of the role entries.
NOTE
In some cases, the value of the
nsRoleDNattribute
must be protected with an ACI, as
the attribute is writable. For more information about security and roles, see
Section 5.1.4,
“Using Roles Securely”
.
5.1.3.1. Examples: Managed Role Definition
Example Corporation's administrator is creating a role to be assigned to all marketing staff by doing
the following:
1. Run
ldapmodify
with the
-a
option to add a new entry: