Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 130 / 552

Chapter 5. Managing Entries with Roles, Classes of Service, and Views
112
attribute. The
nsRole
attribute is a computed attribute, which identifies to which roles an entry
belongs; the
nsRole
attribute is not stored with the entry itself. From the client application point of
view, the method for checking membership is uniform and is performed on the server side.
NOTE
The
nsRole
attribute is an operational attribute. In LDAP, operational attributes must be
requested explicitly in the search attributes list; they are not returned by default with the
regular attributes in the schema of the entry. For example, this
ldapsearch
command
returns the list of roles of which
uid=scarter
is a member, in addition to the regular
attributes for the entry:
ldapsearch ... args ... “(uid=scarter)” \* nsRole
Be sure to use the
nsRole
attribute, not the
nsRoleDN
attribute, to evaluate role
membership.
The Console will automatically show the roles.
Each role has
members
, or entries that possess the role. Members can be specified either explicitly
or dynamically. How role membership is specified depends upon the type of role. Directory Server
supports three types of roles:
•
Managed roles
have an explicit enumerated list of members.
•
Filtered roles
are assigned entries to the role depending upon the attribute contained by each entry,
specified in an LDAP filter. Entries that match the filter are said to possess the role.
•
Nested roles
are roles that contain other roles.
The concept of activating/inactivating roles allows entire groups of entries to be activated or
inactivated in just one operation. That is, the members of a role can be temporarily disabled by
inactivating the role to which they belong.
When a role is inactivated, it does not mean that the user cannot bind to the server using that
role entry. The meaning of an inactivated role is that the user cannot bind to the server using any
of the entries that belong to that role; the entries that belong to an inactivated role will have the
nsAccountLock
attribute set to
true
.
In the case of the nested role, an inactivated nested role means that a user cannot bind to the server
using an entry that belongs to a role that is a member of the nested role. All the entries that belong to
a role that directly or indirectly are members of the nested role (one may have several levels of nested
roles) will have
nsAccountLock
set to
true
.
NOTE
The
nsAccountLock
attribute is an operational attribute and must be explicitly requested
in the search command in the list of search attributes. For example:
ldapsearch ... args ... “(uid=scarter)” \* nsAccountLock
The Console will automatically show the active/inactive status of entries.