Netscape NETSCAPE DIRECTORY SERVER 6.02, Руководство администратора

Страница: 232 / 568

Access Control Usage Examples
232 Netscape Directory Server Administrator’s Guide • May 2002
7.
Click OK in the Access Control Editor window.
The new ACI is added to the ones listed in the Access Control Manager
window.
ACI “Anonymous World”
In LDIF, to grant read and search access of the individual subscribers subtree to the
world, while denying access to information on unlisted subscribers, you could
write the following statement:
aci: (targetfilter= "(!(unlistedSubscriber=yes))")
(targetattr="homePostalAddress || homePhone || mail") (version 3.0;
acl "Anonymous World"; allow (read, search) userdn=
"ldap:///anyone";)
This example assumes that the ACI is added to the
ou=subscribers,dc=example,dc=com
entry. It also assumes that every subscriber
entry has an
unlistedSubscriber
attribute which is set to yes or no. The target
definition filters out the unlisted subscribers based on the value of this attribute.
For details on the filter definition, refer to “Setting a Target Using Filtering,” on
page 246.
From the Console, you can set this permission by doing the following:
1.
On the Directory tab, right click the Subscribers entry under the
example.com
node in the left navigation tree, and choose Set Access Permissions from the
pop-up menu to display the Access Control Manager.
2.
Click New to display the Access Control Editor.
3.
On the Users/Groups tab, in the ACI name field, type "Anonymous World".
Check that All Users is displayed in the list of users granted access permission.
4.
On the Rights tab, tick the checkboxes for read, and search rights. Make sure
the other checkboxes are clear.
5.
On the Targets tab, click This Entry to display the
dc=subscribers,
dc=example,dc=com
suffix in the target directory entry field.
a.
In the filter for subentries field, type the following filter:
(!(unlistedSubscriber=yes))