HP UX Red Hat Direry Server Software manual Setting a Target Using Filtering

Chapter 6. Managing Access Control

All other checkboxes should be clear; if it is easier, click the Check None button to clear the checkboxes for all attributes in the table, then click the Name header to organize them alphabetically, and select the appropriate ones.

This example assumes that the connectionTime and accountBalance attributes were added to the schema.

7. Click OK.

The new ACI is added to the ones listed in the Access Control Manager window.

9.8. Setting a Target Using Filtering

To set access controls that allow access to a number of entries that are spread across the directory, consider using a filter to set the target.

NOTE

Because search filters do not directly name the object for which you are managing access, it is easy to allow or deny access to the wrong objects unintentionally, especially as your directory becomes more complex. Additionally, filters can make it difficult to troubleshoot access control problems within your directory.

For example, the following ACI grants user bjensen write access to the department number, home phone number, home postal address, and manager attributes for all members of the accounting organization.

aci: (targetattr="departmentNumber homePhone homePostalAddress

manager")

(targetfilter="(uid=bjensen)") (version 3.0; acl "Filtered ACL"; allow

(write)

userdn ="ldap:///cn=*,ou=accounting, dc=example,dc=com";)

Before you can set these permissions, you must create the accounting branch point ou=accounting,dc=example,dc=com). You can create organizational unit branch points in the Directory tab on the Directory Server Console.

9.9.Allowing Users to Add or Remove Themselves from a Group

Many directories set ACIs that allow users to add or remove themselves from groups. This is useful, for example, for allowing users to add and remove themselves from mailing lists.

232