Sun Microsystems Netscape Enterprise Server, Руководство администратора

Страница: 346 / 532

Restricting Access to Your Web Site
346 Netscape Enterprise Server Administrator’s Guide
Writing Customized Expressions
You can enter custom expressions for an ACL. You can use this feature if you
are familiar with the syntax and structure of ACL files. There are a few features
available only by editing the ACL file or creating custom expressions. For
example, you can restrict access to your server depending on the time of day,
day of the week, or both.
The following customized expression shows how you could restrict access by
time of day and day of the week. This example assumes you have two groups
in your LDAP directory: the “regular” group gets access Monday through Friday,
8:00am to 5:00pm. The “critical” group gets access all the time.
allow (read)
{
(group=regular and dayofweek=”mon,tue,wed,thu,fri”);
(group=regular and (timeofday>=0800 and timeofday<=1700));
(group=critical)
}
For more information on valid syntax and ACL files, see “ACL File Syntax” on
page 456 and “Referencing ACL Files in obj.conf” on page 462.
Selecting “Access control on”
When you uncheck the option labeled “Access control on,” you’ll get a prompt
asking if you want to erase records in the ACL. When you click OK, the server
deletes the ACL entry for that resource from the ACL file.
If you want to deactivate an ACL, you can comment out the ACL lines in the file
generated-https-server-id.acl
by putting # signs at the beginning of
each line.
From Enterprise Administration Server, you could create and turn on access
control for a specific server instance and leave it off (which is the default) for
other servers. For example, you could deny all access to the Server Manager
pages from Enterprise Administration Server. With distributed administration on
and access control off by default for any other servers, administrators could still
access and configure the other servers, but they cannot configure Enterprise
Administration Server.