Red Hat DIRECTORY SERVER 8.0, Руководство администратора

Страница: 204 / 552

Chapter 6. Managing Access Control
186
1. In the
Directory
tab, right-click the
example.com
node in the left navigation tree, and choose
Set
Access Permissions
from the pop-up menu to display the
Access Control Manager
.
2. Click
New
to display the
Access Control Editor
.
3. In the
Users/Groups
tab in the
ACI name
field, type
Anonymous example.com
. Check that
All
Users
opens in the list of users granted access permission.
4. In the
Rights
tab, select the checkboxes for
read
,
compare
, and
search
rights. Make sure the
other checkboxes are clear.
5. In the
Targets
tab, click
This Entry
to display the
dc=example,dc=com
suffix in the
Target
directory entry
field. In the attribute table, locate the
userPassword
attribute, and clear the
corresponding checkbox.
All other checkboxes should be selected. This task is made easier if you click the
Name
header to
organize the list of attributes alphabetically.
6. In the
Hosts
tab, click
Add
, and in the
DNS host filter
field, type
*.example.com
. Click
OK
to
dismiss the dialog box.
7. Click
OK
in the
Access Control Editor
window.
The new ACI is added to the ones listed in the
Access Control Manager
window.
6.9.1.2. ACI "Anonymous World"
In LDIF, to grant read and search access of the individual subscribers subtree to the world, while
denying access to information on unlisted subscribers, write the following statement:
aci: (targetfilter= "(!(unlistedSubscriber=yes))")
(targetattr="homePostalAddress || homePhone || mail") (version
3.0; acl "Anonymous World"; allow (read, search) userdn="ldap:///anyone";)
This example assumes that the ACI is added to the
ou=subscribers,dc=example,dc=com
entry.
It also assumes that every subscriber entry has an
unlistedSubscriber
attribute which is set to
yes
or
no
. The target definition filters out the unlisted subscribers based on the value of this attribute.
For details on the filter definition, see
Section 6.9.8, “Setting a Target Using Filtering”
.
From the Console, set this permission by doing the following:
1. In the
Directory
tab, right-click the
Subscribers
entry under the
example.com
node in the
left navigation tree, and choose
Set Access Permissions
from the pop-up menu to display the
Access Control Manager
.
2. Click
New
to display the
Access Control Editor
.
3. In the
Users/Groups
tab, in the
ACI name
field, type
Anonymous World
. Check that
All
Users
opens in the list of users granted access permission.
4. In the
Rights
tab, select the checkboxes for
read
and
search
rights. Make sure the other
checkboxes are clear.
5. In the
Targets
tab, click
This Entry
to display the
ou=subscribers, dc=example,dc=com
suffix in the
Target directory entry
field.