Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Руководство администратора

Страница: 245 / 578

Access Control Usage Examples
Chapter 6 Managing Access Control 245
d.
Click OK to dismiss the Add Users and Groups dialog box.
4.
On the Rights tab, tick the checkbox for add. Make sure the other checkboxes
are clear.
5.
On the Targets tab, click This Entry to display the
ou=social committee,
dc=example,dc=com
suffix in the target directory entry field.
6.
On the Hosts tab, click Add to display the Add Host Filter dialog box. In the
DNS host filter field, type
*.example.com
. Click OK to dismiss the dialog box.
7.
To create the value-based filter that will allow employees to add only group
entries to this subtree, switch to manual editing by clicking the Edit Manually
button. Add the following to the beginning of the LDIF statement:
(targattrfilters="add=objectClass:(objectClass=groupOfNames)")
The LDIF statement should read as follows:
(targattrfilters="add=objectClass:(objectClass=groupOfNames)")
(targetattr = "*") (target="ldap:///ou=social
committee,dc=example,dc=com) (version 3.0; acl "Create Group";
allow (read,search,add) (userdn= "ldap:///all") and
(dns="*.example.com"); )
8.
Click OK.
The new ACI is added to the ones listed in the Access Control Manager
window.
ACI “Delete Group”
In LDIF, to grant
example.com
employees the right to modify or delete a group
entry which they own under the
ou=Social Comittee branch
, you would write
the following statement:
aci: (target="ou=social committee,dc=example,dc=com)
(targattrfilters="del=objectClass:(objectClass=groupOfNames)")
(version 3.0; acl "Delete Group"; allow (delete) userattr=
"owner#GROUPDN";)
This example assumes that the
aci
is added to the
ou=social committee,
dc=example,dc=com
entry.
Using the Console is not an effective way of creating this ACI because you would
have to use manual editing mode to create the target filter, and to check group
ownership.