Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Руководство администратора

Страница: 234 / 578

Access Control Usage Examples
234 Netscape Directory Server Administrator’s Guide • August 2002
Deleting an ACI
To delete an ACI:
1.
On the Directory tab, right-click the top entry in the subtree, and choose Set
Access Permissions from the pop-up menu.
The Access Control Manager window is displayed. It contains the list of ACIs
belonging to the entry.
2.
In the Access Control Manager window, select the ACI that you want to delete.
3.
Click Remove.
The ACI is no longer listed in the Access Control Manager.
Access Control Usage Examples
The examples provided in this section illustrate how an imaginary ISP company,
example.com
, would implement its access control policy. All the examples explain
how to perform a given task from the Console and using an LDIF file.
example.com
’s business is to offer a web hosting service and internet access. Part of
example.com
’s web hosting service is to host the directories of client companies.
example.com
actually hosts and partially manages the directories of two
medium-sized companies, HostedCompany1, and HostedCompany2. It also
provides internet access to a number of individual subscribers.
These are the access control rules that
example.com
wants to put in place:
• Grant anonymous access for read, search, and compare to the entire
example.com
tree for
example.com
employees (see “Granting Anonymous
Access,” on page 235).
• Grant write access to
example.com
employees for personal information for
such as
homeTelephoneNumber
,
homeAddress
(see “Granting Write Access to
Personal Entries,” on page 237).
• Grant
example.com
employees the right to add any role to their entry, except
certain critical roles (see “Restricting Access to Key Roles,” on page 241).
• Grant the
example.com
Human Resources group all rights on the entries in
the People branch (see “Granting a Group Full Access to a Suffix,” on
page 242).