HP UX Red Hat Direry Server Software manual Default ACIs

Default ACIs

When creating an access control policy for your directory service, you need to be aware of the following restrictions:

•If your directory tree is distributed over several servers using the chaining feature, some restrictions apply to the keywords you can use in access control statements:

•ACIs that depend on group entries (groupdn keyword) must be located on the same server as the group entry. If the group is dynamic, then all members of the group must have an entry on the server, too. If the group is static, the members' entries can be located on remote servers.

•ACIs that depend on role definitions (roledn keyword) must be located on the same server as the role definition entry. Every entry that is intended to have the role must also be located on the same server.

However, you can match values stored in the target entry with values stored in the entry of the bind user; for example, using the userattr keyword. Access is evaluated normally even if the bind user does not have an entry on the server that holds the ACI.

For more information on how to chain access control evaluation, see Section 3.5, “Database Links and Access Control Evaluation”.

•Attributes generated by class of service (CoS) cannot be used in all ACI keywords. Specifically, you should not use attributes generated by CoS with the following keywords:

•targetfilter (Section 3.2.4, “Targeting Entries or Attributes Using LDAP Filters”)

•targattrfilters (Section 3.2.2, “Targeting Attributes”)

•userattr (Section 4.5.1, “Using the userattr Keyword”)

If you create target filters or bind rules that depend on the value of attributes generated by CoS, the access control rule will not work. For more information on CoS, see Chapter 5, Managing Entries with Roles, Class of Service, and Views.

•Access control rules are always evaluated on the local server. Therefore, it is not necessary to specify the hostname or port number of the server in LDAP URLs used in ACI keywords. If you do, the LDAP URL is not taken into account at all. For more information on LDAP URLs, see Appendix C, LDAP URLs.

2. Default ACIs

When the Administration Server is set up, the following default ACIs apply to the directory information stored in the userRoot database:

•Users can modify a list of common attributes in their own entries, including the mail, telephoneNumber, userPassword, and seeAlso attributes. Operational and most of the

171