Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 170 / 552

Chapter 6. Managing Access Control
152
attribute must be satisfied. If individual values of an attribute already present in the entry are replaced,
then both the add and delete filters must be satisfied.
For example, consider the following attribute filter:
(targattrfilters="add=nsroledn:(!(nsroledn=cn=superAdmin)) && telephoneNumber:
(telephoneNumber=123*)")
This filter can be used to allow users to add any role (
nsroledn
attribute) to their own entry, except
the
superAdmin
role. It also allows users to add a telephone number with a 123 prefix.
NOTE
You cannot create value-based ACIs from the Directory Server Console.
6.3.2.6. Targeting a Single Directory Entry
Targeting a single directory entry is not straightforward because it goes against the design philosophy
of the access control mechanism. However, it can be done in either of two ways:
• By creating a bind rule that matches user input in the bind request with an attribute value stored in
the targeted entry. For more details, see
Section 6.4.5, “Defining Access Based on Value Matching”
.
• By using the
targetattr
and
targetfilter
keywords.
You can use the
targetattr
keyword to specify an attribute that is only present in the entry you
want to target, and not in any of the entries below your target. For example, if you want to target
ou=people,dc=example,dc=com
, and there are not any organizational units (
ou
) defined below
that node, you could specify an ACI that contains
targetattr=ou
.
A safer method is to use the
targetfilter
keyword and to specify explicitly an attribute value that
appears in the entry alone. For example, during the installation of the Directory Server, the following
ACI is created:
aci: (targetattr="*")(targetfilter=(o=NetscapeRoot))(version 3.0;
acl "Default anonymous access"; allow (read, search) userdn="ldap:///anyone";)
This ACI can apply only to the
o=NetscapeRoot
entry.
The risk associated with these method is that your directory tree might change in the future, and you
would have to remember to modify this ACI.
6.3.3. Defining Permissions
Permissions specify the type of access you are allowing or denying. You can either allow or deny
permission to perform specific operations in the directory. The various operations that can be assigned
are known as
rights
.
There are two parts to setting permissions:
• Allowing or denying access