Red Hat DIRECTORY SERVER 8.0, Administration Manual

Page: 208 / 552

Chapter 6. Managing Access Control
190
When a role gives any sort of privileged user rights over critical corporate or business functions,
consider restricting access to that role. For example, at
example.com
, employees can add any role to
their own entry except the
superAdmin
role. This is illustrated in
Section 6.9.3.1, “ACI "Roles"”
.
6.9.3.1. ACI "Roles"
In LDIF, to grant
example.com
employees the right to add any role to their own entry except the
superAdmin
role, write the following statement:
aci: (targetattr = "nsroledn")
(targattrfilters="add=nsroledn:(nsroledn !=
"cn=superAdmin,dc=example,dc=com")") (version 3.0; acl "Roles";
allow (write) userdn= "ldap:///self" and dns="*.example.com";)
This example assumes that the ACI is added to the
ou=example-people,dc=example,dc=com
entry.
From the Console, set this permission by doing the following:
1. In the
Directory
tab, right-click the
example-people
entry under the
example.com
node in the
left navigation tree, and choose
Set Access Permissions
from the pop-up menu to display the
Access Control Manager
.
2. Click
New
to display the
Access Control Editor
.
3. In the
Users/Groups
tab, in the
ACI name
field, type
Roles
. In the list of users granted access
permission, do the following:
a. Select and remove
All Users
, then click
Add
.
The
Add Users and Groups
dialog box opens.
b. Set the
Search
area in the
Add Users and Groups
dialog box to
Special Rights
, and
select
Self
from the search results list.
c. Click the
Add
button to list
Self
in the list of users who are granted access permission.
d. Click
OK
to dismiss the
Add Users and Groups
dialog box.
4. In the
Rights
tab, select the checkbox for
write
. Make sure the other checkboxes are clear.
5. In the
Targets
tab, click
This Entry
to use the
ou=example-people,dc=example,dc=com
suffix in the
Target directory entry
field.
6. In the
Hosts
tab, click
Add
to display the
Add Host Filter
dialog box. In the
DNS host filter
field,
type
*.example.com
. Click
OK
to dismiss the dialog box.
7. To create the value-based filter for roles, switch to manual editing by clicking the
Edit Manually
button. Add the following to the beginning of the LDIF statement:
(targattrfilters="add=nsroledn:(nsroledn != "cn=superAdmin, dc=example,dc=com")")
The LDIF statement should read as follows:
(targattrfilters="add=nsroledn:(nsroledn != "cn=superAdmin,