Novell EDIRECTORY 8.8 - GUIDE, Руководство пользователя

Страница: 64 / 574

64 Novell eDirectory 8.8 Administration Guide
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
6a To add a rights assignment, click Add Object , select the object to control access to, click
OK , click Assigned Rights , assign the trustee's rights, then click Done .
6b
To modify a rights assignment, select the object you want to control access to, click
Assigned Rights , modify the trustee's rights assignment as needed, then click Done .
When creating or modifying a rights assignment, you can grant or deny access to the
object as a whole, to all the properties of the object, and to individual properties.
6c To remove a rights assignment, select the object you want to control access to, then click
Delete Object .
The trustee no longer has explicit rights to the object or its properties but might still have
effective rights through inheritance or security equivalence.
7
Click OK .
Granting Equivalence
A user who is security equivalent to another eDirectory object effectively has all the rights of that
object. A user is automatically security equivalent to the groups and roles that they belong to. All
users are implicitly security equivalent to the [Public] trustee and to each container above their User
objects in the eDirectory tree, including the Tree object. You can also explicitly grant a user security
equivalence to any eDirectory object.
NOTE: The tasks in this section allow you to delegate administrative authority through eDirectory
rights. If you have administration applications that use Role-Based Services (RBS) roles, you can
also delegate administrative authority by assigning users membership in those roles.
• “Granting Security Equivalence by Membership” on page 64
• “Granting Security Equivalence Explicitly” on page 65
• “Setting Up an Administrator For an Object's Specific eDirectory Properties” on page 65
Granting Security Equivalence by Membership
1 If you haven't already done so, create the group or role object that you want the users to be
security equivalent to.
See “Creating an Object” on page 94 for details.
2 Grant the group or role the eDirectory rights that you want the users to have.
See
“Assigning Rights Explicitly” on page 63 for details.
3 Edit the membership of the group or role to include those users who need the rights of the
group or role.
• For a Group object, use the Members property page.
In Novell iManager, click eDirectory Administration > Modify Object , specify the name
and context of a Group object, click OK , then click the Members tab.
• For an Organizational Role object, use the Role Occupant field on the Role Occupant
property page.
In Novell iManager, click
eDirectory Administration > Modify Object , specify the name
and context of an rbsRole object, click OK , then click Role Occupant on the General tab.
• For an rbsRole object, use the Modify iManager Members page.