Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 178 / 552

Chapter 6. Managing Access Control
160
Scenario Example Description
For example, if you want to grant read access to the entire tree
to all authenticated users, you would create the following ACI
on the
dc=example,dc=com
node:
aci:(version 3.0; acl "all-read"; allow (read) userdn="ldap:///all";)
Userdn keyword containing the anyone keyword userdn = "ldap:///anyone";
The bind rule is evaluated to be true for anyone; use this
keyword to provide anonymous access to your directory.
For example, if you want to allow anonymous read and search
access to the entire
example.com
tree, you would create the
following ACI on the
dc=example,dc=com
node:
aci: (version 3.0; acl "anonymous-read-search"; allow
(read,search) userdn = "ldap:///anyone";)
Userdn keyword containing the parent keyword userdn = "ldap:///parent";
The bind rule is evaluated to be true if the bind DN is the
parent of the targeted entry.
For example, if you want to grant write access to every user's
child entries, you would create the following ACI on the
dc=example,dc=com
node:
aci:(version 3.0; acl "parent access"; allow (write)
userdn="ldap:///parent";)
Table 6.4. userdn Keyword Examples
6.4.3. Defining Group Access - groupdn Keyword
Members of a specific group can access a targeted resource. This is known as
group access
. Group
access is defined using the
groupdn
keyword to specify that access to a targeted entry is granted or
denied if the user binds using a DN that belongs to a specific group.
The
groupdn
keyword requires one or more valid distinguished names in the following format:
groupdn="ldap:/// dn [|| ldap:/// dn ]...[|| ldap:/// dn ]"
The bind rule is evaluated to be true if the bind DN belongs to the named group.
NOTE
If a DN contains a comma, the comma must be escaped by a backslash (
\
).
From the Directory Server Console, you can define specific groups using the
Access Control Editor
.
For more information, see
Section 6.5, “Creating ACIs from the Console”
.
Scenario Example Description
Groupdn keyword containing an LDAP URL groupdn = "ldap:///
cn=Administrators,dc=example,dc=com"; The bind rule is evaluated to be true if the bind DN belongs
to the Administrators group. If you wanted to grant the
Administrators group permission to write to the entire