HP UX Red Hat Direry Server Software Defining Permissions, Targeting a Single Directory Entry

Chapter 6. Managing Access Control

except the superAdmin role. It also allows users to add a telephone number with a 123 prefix.

NOTE

You cannot create value-based ACIs from the Directory Server Console.

3.2.6. Targeting a Single Directory Entry

Targeting a single directory entry is not straightforward because it goes against the design philosophy of the access control mechanism. However, it can be done in either of two ways:

•By creating a bind rule that matches user input in the bind request with an attribute value stored in the targeted entry. For more details, see Section 4.5, “Defining Access Based on Value Matching”.

•By using the targetattr and targetfilter keywords.

You can use the targetattr keyword to specify an attribute that is only present in the entry you want to target, and not in any of the entries below your target. For example, if you want to target ou=people,dc=example,dc=com, and there are not any organizational units (ou) defined below that node, you could specify an ACI that contains targetattr=ou.

A safer method is to use the targetfilter keyword and to specify explicitly an attribute value that appears in the entry alone. For example, during the installation of the Directory Server, the following ACI is created:

aci: (targetattr="*")(targetfilter=(o=NetscapeRoot))(version 3.0;

acl "Default anonymous access"; allow (read, search)

userdn="ldap:///anyone";)

This ACI can apply only to the o=NetscapeRoot entry.

The risk associated with these method is that your directory tree might change in the future, and you would have to remember to modify this ACI.

3.3. Defining Permissions

Permissions specify the type of access you are allowing or denying. You can either allow or deny permission to perform specific operations in the directory. The various operations that can be assigned are known as rights.

There are two parts to setting permissions:

• Allowing or denying access

180