Netscape NETSCAPE DIRECTORY SERVER 6.02, Руководство администратора

Страница: 202 / 568

Creating ACIs Manually
202 Netscape Directory Server Administrator’s Guide • May 2002
Targeting a Single Directory Entry
Targeting a single directory entry is not straightforward because it goes against the
design philosophy of the access control mechanism. However, it can be done:
• By creating a bind rule that matches user input in the bind request with an
attribute value stored in the targeted entry. For more details, see “Defining
Access Based on Value Matching,” on page 213.
• By using the
targetattr
and
targetfilter
keywords
You can use the
targetattr
keyword to specify an attribute that is only present in
the entry you want to target, and not in any of the entries below your target. For
example, if you want to target
ou=people,dc=example,dc=com
, and there aren’t
any organizational units (
ou
) defined below that node you could specify an ACI
that contains:
targetattr=ou
A safer method is to use the
targetfilter
keyword and to explicitly specify an
attribute value that appears in the entry alone. For example, during the installation
of the Directory Server, the following ACI is created:
aci: (targetattr="*")(targetfilter=(o=NetscapeRoot))(version 3.0;
acl "Default anonymous access"; allow (read, search)
userdn="ldap:///anyone";)
This ACI can apply only to the
o=NetscapeRoot
entry.
The risk associated with these methods is that your directory tree might change in
the future, and you would have to remember to modify this ACI.
Defining Permissions
Permissions specify the type of access you are allowing or denying. You can either
allow or deny permission to perform specific operations in the directory. The
various operations that can be assigned are known as rights.
There are two parts to setting permissions:
• Allowing or denying access
• Assigning rights