Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Руководство администратора

Страница: 167 / 578

Using Roles
Chapter 5 Advanced Entry Management 167
• Remove a particular role from a given entry.
You can do everything you would normally do with static groups with managed
roles, and you can filter members using filtered roles as you used to do with
dynamic groups. Roles are easier to use than groups, more flexible in their
implementation, and reduce client complexity.
However, evaluating roles is more resource intensive because the server does the
work for the client application. With roles, the client application can check role
membership by searching the
nsRole
attribute. The
nsRole
attribute is a computed
attributed that is not stored with the entry itself, which identifies which roles an
entry belongs to. From the client application point of view, the method for
checking membership is uniform and is performed on the server side.
Each role has members, or entries that possess the role. You can specify members
either explicitly or dynamically. How you specify role membership depends upon
the type of role you are using. Directory Server supports three types of roles:
• Managed roles—A managed role allows you to create an explicit enumerated
list of members.
• Filtered roles—A filtered role allows you to assign entries to the role
depending upon the attribute contained by each entry. You do this by
specifying an LDAP filter. Entries that match the filter are said to possess the
role.
• Nested roles—A nested role allows you to create roles that contain other roles.
For more information about how roles work, refer to Netscape Directory Server
Deployment Guide.
Managing Roles Using the Console
This section contains the following procedures for creating and modifying roles:
• Creating a Managed Role
• Creating a Filtered Role
• Creating a Nested Role
• Viewing and Editing an Entry’s Roles
• Modifying a Role Entry
• Making a Role Inactive
• Reactivating a Role