HP UX Red Hat Direry Server Software manual Creating ACIs from the Console, 202

Chapter 6. Managing Access Control

Because Boolean expressions are evaluated from left to right, in the first case, bind rule A is evaluated before bind rule B, and, in the second case, bind rule B is evaluated before bind rule A.

However, the Boolean NOT is evaluated before the Boolean OR and Boolean AND. Thus, in the following example, bind rule B is evaluated before bind rule A despite the left-to-right rule.

(bind_rule_A) AND NOT (bind_rule_B)

5. Creating ACIs from the Console

You can use the Directory Server Console to view, create, edit, and delete access control instructions for your directory:

•Section 5.1, “Displaying the Access Control Editor”

•Section 5.2, “Creating a New ACI”

•Section 5.3, “Editing an ACI”

•Section 5.4, “Deleting an ACI”

See Section 9, “Access Control Usage Examples” for a collection of access control rules commonly used in Directory Server security policies, along with step-by-step instructions for using the Directory Server Console to create them.

The Access Control Editor prevents creating more complex ACIs in visual editing mode, especially ACIs with any of these characteristics:

•Deny access (Section 3.3.4, “Permissions Syntax”).

•Create value-based ACIs (Section 3.2.2, “Targeting Attributes”).

•Define parent access (Section 4.2.4, “Parent Access (parent Keyword)”).

•Create ACIs that contain Boolean bind rules (Section 4.10, “Using Boolean Bind Rules”).

•Create ACIs that use the roledn, userattr, authmethod keywords.

TIP

In the Access Control Editor, click the Edit Manually button at any time to check the LDIF representation of the ACI changes made through the graphical interface.

202