Novell EDIRECTORY 8.8 - GUIDE, Руководство пользователя

Страница: 58 / 574

58 Novell eDirectory 8.8 Administration Guide
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
• Read lets the trustee see the values of a property. It includes the Compare right.
• Write lets the trustee create, change, and delete the values of a property.
• Add Self lets the trustee add or remove itself as a property value. It only applies to properties
with object names as values, such as membership lists or Access Control Lists (ACLs).
Effective Rights
Users can receive rights in a number of ways, such as explicit trustee assignments, inheritance, and
security equivalence. Rights can also be limited by Inherited Rights Filters and changed or revoked
by lower trustee assignments. The net result of all these actions—the rights a user can employ—are
called
effective rights .
A user’s effective rights to an object are calculated each time the user attempts an action.
How Effective Rights Are Calculated
Each time a user attempts to access a network resource, eDirectory calculates the user’s effective
rights to the target resource using the following process:
1. eDirectory lists the trustees whose rights are to be considered in the calculation. These include
• The user who is attempting to access the target resource.
• The objects that the user is security equivalent to.
2. For each trustee in the list, eDirectory determines its effective rights as follows:
a. eDirectory starts with the inheritable rights that the trustee has at the top of the tree.
eDirectory checks the Object Trustees (ACL) property of the Tree object for entries that
list the trustee. If any are found and they are inheritable, eDirectory uses the rights
specified in those entries as the initial set of effective rights for the trustee.
b. eDirectory moves down a level in the branch of the tree that contains the target resource.
c. eDirectory removes any rights that are filtered at this level.
eDirectory checks the ACL at this level for Inherited Rights Filters (IRFs) that match with
the right types (object, all properties, or a specific property) of the trustee’s effective
rights. If any are found, eDirectory removes from the trustee’s effective rights any rights
that are blocked by those IRFs.
For example, if the trustee’s effective rights so far include an assignment of Write All
Properties, but an IRF at this level blocks Write All Properties, the system removes Write
All Properties from the trustee’s effective rights.
d. eDirectory adds any inheritable rights that are assigned at this level, overriding as needed.
eDirectory checks the ACL at this level for entries that list the trustee. If any are found,
and they are inheritable, eDirectory copies the rights from those entries to the trustee’s
effective rights, overriding as needed.
For example, if the trustee’s effective rights so far include the Create and Delete object
rights but no property rights, and if the ACL at this level contains both an assignment of
zero object rights and an assignment of Write all properties for this trustee, then the
system replaces the trustee’s existing object rights (Create and Delete) with zero rights and
adds the new all property rights.
e. eDirectory repeats the filtering and adding steps (c and d above) at each level of the tree,
including at the target resource.