Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Руководство администратора

Страница: 244 / 578

Access Control Usage Examples
244 Netscape Directory Server Administrator’s Guide • August 2002
At
example.com
for example, there is an active social committee that is organized
into various clubs: tennis, swimming, skiing, role-playing, etc. Any
example.com
employee can create a group entry representing a new club. This is illustrated in
the ACI “Create Group” example. Any
example.com
employee can become a
member of one of these groups. This is illustrated in ACI “Group Members” under
“Allowing Users to Add or Remove Themselves From a Group,” on page 251. Only
the group owner can modify or delete a group entry. This is illustrated in the ACI
“Delete Group” example.
ACI “Create Group”
In LDIF, to grant
example.com
employees the right to create a group entry under
the
ou=Social Committee
branch, you would write the following statement:
aci: (target="ldap:///ou=social committee,dc=example,dc=com)
(targattrfilters="add=objectClass:(objectClass=groupOfNames)")
(version 3.0; acl "Create Group"; allow (add)
(userdn= "ldap:///uid=*,ou=example-people,dc=example,dc=com") and
dns="*.example.com";)
This example assumes that the ACI is added to the
ou=social committee,
dc=example,dc=com
entry.
From the Console, you can set this permission by doing the following:
1.
On the Directory tab, right click the Social Committee entry under the
example.com
node in the left navigation tree, and choose Set Access
Permissions from the pop-up menu to display the Access Control Manager.
2.
Click New to display the Access Control Editor.
3.
On the Users/Groups tab, in the ACI name field, type "Create Group". In the
list of users granted access permission, do the following:
a.
Select and remove All Users, then click Add.
The Add Users and Groups dialog box is displayed.
b.
Set the Search area to Special Rights, and select All Authenticated Users
from the Search results list.
c.
Click the Add button to list All Authenticated Users in the list of users who
are granted access permission.
NOTE
This ACI does not grant write permission, which means that the
entry creator cannot modify the entry.