Novell EDIRECTORY 8.8 SP3, Руководство администратора, Страница: 66 / 634

66 Novell eDirectory 8.8 Administration Guide
n
ov
do
cx (e
n)
11
Ju
ly 20
08
1.10.4 Delegated Administration
eDirectory lets you delegate administration of a branch of the tree, revoking your own management
rights to that branch. One reason for this approach is that special security requirements require a
different administrator with complete control over that branch.
To delegate administration:
1
Grant the Supervisor object right to a container.
1a In Novell iManager, click the Roles and Tasks button Description: Roles and Tasks
button .
1b Click Rights > Modify Trustees .
1c Enter the name and context of the container object that you want to control access to, then
click
OK .
1d Click Assigned Rights .
1e
Click the Supervisor checkbox for the properties you want.
1f Click Done , then click OK .
2
Create an IRF on the container that filters the Supervisor and any other rights you want
blocked.
2a In Novell iManager, click the Roles and Tasks button Description: Roles and Tasks
button
2b Click Rights > Modify Inherited Rights Filter .
2c Specify the name and context of the object whose inherited rights filter you want to
modify, then click
OK .
2d Edit the list of inherited rights filters as needed.
To edit the list of filters, you must have the Supervisor or Access Control right to the ACL
property of the object. You can set filters that block inherited rights to the object as a
whole, to all the properties of the object, and to individual properties.
NOTE: These filters won't block rights that are explicitly granted a trustee on this object,
since such rights aren't inherited.
2e
Click OK .
Tree The Tree Read property right to the Host Server Name
and Host Resource properties on all Volume objects.
This gives all objects access to the physical volume
name and physical server name.
Container objects Read and File Scan rights to sys: \public. This allows
User objects under the container to access NetWare
utilities in \public.
User objects If home directories are automatically created for users,
the users have the Supervisor right to those directories.
Default Trustees Default Rights