Sun Microsystems Netscape Enterprise Server, Руководство администратора

Страница: 332 / 532

How Does Access Control Work?
332 Netscape Enterprise Server Administrator’s Guide
allowed or denied. Each ACE specifies whether or not the server should
continue to the next ACE in the hierarchy. The collection of ACEs is called an
access control list (ACL).When a request comes in to the server, the server
looks in
obj.conf
for a reference to an ACL, which is then used to determine
access. By default, the server has one ACL file that contains multiple ACLs.
When the server gets a request for a page, the server uses the rules in the ACL
file to determine if it should grant access or not. The rules can reference the
hostname or IP address of the computer sending the request. The rules can also
reference users and groups stored in the LDAP directory.
For example, the following ACL file contains the two default entries for
Enterprise Administration Server (
admin-serv
) plus an additional entry that
allows users in the “admin-reduced” group to access the Preferences tab in
Enterprise Administration Server.
version 3.0;
# The following "es-internal" rules protect files such
# as icons and images related to Enterprise Server.
# These "es-internal" rules should not be modified.
acl "es-internal";
allow (read, list, execute,info) user = "anyone";
deny (write, delete) user = "anyone";
# The following "default" rules apply to the entire document
# directory of Enterprise Server. In this example, the rules
# are set up so that "all" users in the directory server are
# allowed to read, execute, list, and get information.
# The "all" users are not allowed to write to or delete any files.
# All clients that accesses the document directory of the web
# server will be required to submit a username and password
# since this example is using the "basic" method of
# authentication. A client must be in the directory server
# to gain access to this default directory since "anyone"
# not in the directory server is denied, and "all" in the
# directory server are allowed.
acl "default";
authenticate (user,group) {
database = "default";
method = "basic";
};
deny (all)
(user = "anyone");