Novell EDIRECTORY 8.8 - GUIDE, Руководство пользователя

Страница: 56 / 574

56 Novell eDirectory 8.8 Administration Guide
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
Each time a user attempts to access a network resource, the system calculates the user’s
effective rights to that resource. To ensure that users have the appropriate effective rights to
resources, you can make explicit trustee assignments, grant security equivalences, and filter
inherited rights.
To simplify the assignment of rights, you can create Group and Organizational Role objects,
then assign users to the groups and roles.
• Adding login security
Login security is not provided by default. You can set up several optional login security
measures, including login passwords, login location and time restrictions, limits on concurrent
login sessions, intruder detection, and login disabling.
• Setting up role-based administration
You can set up administrators for specific object properties and grant them rights to only those
properties. This allows you to create administrators with specific responsibilities that can be
inheritable to subordinates of any given container object. A role-based administrator can have
responsibilities over any specific properties, such as those that relate to employee information
or passwords.
See
Installing RBS (http://www.novell.com/documentation/imanager25/imanager_admin_25/
data/am757mw.html#bu1rlq9) in the Novell iManager 2.5 Administration Guide for instruction
on setting up Role-Based Services.
You can also define roles in terms of the specific tasks that administrators can perform in role-
based administration applications. See
Section 3.3, “Configuring Role-Based Services,” on
page 101 for more information.
1.10 eDirectory Rights
When you create a tree, the default rights assignments give your network generalized access and
security. Some of the default assignments are as follows:
• User Admin has the Supervisor right to the top of the tree, giving Admin complete control over
the entire directory. Admin also has the Supervisor right to the NetWare Server object, giving
complete control over any volumes on that server.
• [Public] has the Browse right to the top of the tree, giving all users the right to view any objects
in the tree.
• Objects created through an upgrade process such as a NetWare migration, printing upgrade, or
Windows user migration receive trustee assignments appropriate for most situations.
1.10.1 Trustee Assignments and Targets
The assignment of rights involves a trustee and a target object. The trustee represents the user or set
of users that are receiving the authority. The target represents those network resources the users have
authority over.
• If you make an Alias a trustee, the rights apply only to the object the alias represents. The Alias
object can be an explicit target, however.
• A file or directory in the NetWare file system can also be a target, although file system rights
are stored in the file system itself, not in eDirectory.