Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Руководство администратора

Страница: 175 / 578

Using Roles
Chapter 5 Advanced Entry Management 175
Example: Nested Role Definition
You want to create a role that contains both the marketing staff and sales managers
contained by the roles you created in the previous examples. The nested role you
create using
ldapmodify
appears as follows:
dn: cn=MarketingSales,ou=people,dc=example,dc=com
objectclass: top
objectclass: LDAPsubentry
objectclass: nsRoleDefinition
objectclass: nsComplexRoleDefinition
objectclass: nsNestedRoleDefinition
cn: MarketingSales
nsRoleDN: cn=SalesManagerFilter,ou=people,dc=example,dc=com
nsRoleDN: cn=Marketing,ou=people,dc=example,dc=com
Notice the
nsNestedRoleDefinition
object class inherits from the
LDAPsubentry
,
nsRoleDefinition
, and
nsComplexRoleDefinition
object classes. The
nsRoleDN
attributes contain the DN of the marketing managed role and the sales managers
filtered role.
Both of the users in the previous examples, Bob and Pat, would be members of this
new nested role.
Using Roles Securely
Not every role is suitable for use in a security context. When creating a new role,
consider how easily the role can be assigned to and removed from an entry.
Sometimes it is appropriate for users to be able to easily add themselves to or
remove themselves from a role. For example, if you had an interest group role
called Mountain Biking, you would want interested users to add themselves or
remove themselves easily.
However, in some security contexts it is inappropriate to have such open roles. For
example, consider account inactivation roles. By default, account inactivation roles
contain ACIs defined for their suffix. When creating a role, the server administrator
decides whether a user can assign themselves to or remove themselves from the
role.
For example, user A possesses the managed role, MR. The MR role has been locked
using account inactivation through the command line. This means that user A
cannot bind to the server because the
nsAccountLock
attribute is computed as
“true” for that user. However, suppose the user was already bound and noticed
that he is now locked through the MR role. If there are no ACIs preventing him, the
user can remove the
nsRoleDN
attribute from his entry and unlock himself.