HP UX Direry Server 4.2.2.4 Access control considerations

Figure 4-8 Directory branching for example isp

After creating the initial structure of their directory tree, they create additional branches as follows:

Figure 4-9 Extended branching for example isp

Both the enterprise and the hosting organization design their data hierarchies based on information that is not likely to change often.

4.2.2.4 Access control considerations

Introducing a hierarchy into the directory tree can be used to enable certain types of access control. As with replication, it is easier to group similar entries, then administer them from a single branch.

It is also possible to enable the distribution of administration through a hierarchical directory tree. For example, to give an administrator from the marketing department access to the marketing entries and an administrator from the sales department access to the sales entries, design the directory tree according to those divisions.

Access controls can be based on the directory content rather than the directory tree. The filtered mechanism can define a single access control rule stating that a directory entry has access to all entries containing a particular attribute value. For example, set an ACI filter that gives the sales administrator access to all the entries containing the attribute value ou=Sales.

4.2 Designing the directory tree 45