Access control rules determine who has access to a given directory entry and what level of access is granted. There are two stages to designing an access control rule:

Access control rules are ordered. The first rule in the list is the most specific, the last in the list provides the most general access. The first rule that matches the requested operation is applied, the rest ignored.

Default access is the level of access granted to entries and attributes for which access control is not specifically defined.


Quick Reference


Adding an Access Control Rule

  1. Click on Access Control in the Sections list to display the Access Control screen.

  2. Select Access Control from the Create option button.
    The Create Access Control Rule window is displayed.

  3. Specify the information to which the new rule will apply.

    1. From the Selected Entries menu, select the method of specifying the entries, or choose All Entries.
      You can specify entries using a DN-based regular expression, an LDAP filter, the presence of a particular attribute, or you can specify that the rule applies to all entries.

      • If you selected DN-based regular expression, type the regular expression in the Distinguished Name field, or click Set... to use the Distinguished Name Editor to specify the regular expression.

      • If you selected LDAP filter, click the LDAP filter Set... button to launch the LDAP Filter Editor. Specify the filter, and click Apply.

      If you want to protect only certain attributes within the set of entries defined by the filter, click the Attribute Set... button and select the attributes to be protected. If you do not specify any attributes, all attributes in the specified entries are protected.

    2. Type the name of an attribute to be protected in the Attributes field or click on the Set... button.
      A list of attributes is displayed.

    3. Click on an attribute to add its name to the Attributes list. Click on an attribute a second time to remove it from the Attributes list.
      You can specify any number of attributes.

  4. Choose Access Rule from the Create option button.
    The Add Access Rule window is displayed.

  5. Select the Rule type. This defines the set of users to which the rule applies.
    You can specify a rule for Everyone, DN-based Regular Expression, Self (that is, the entity described by the entry), Address, Domain, or Member Attribute.

    • If you selected Everyone, the rule will apply to all users whose directory entries contain this attribute.

    • If you selected DN-based Regular Expression, specify the regular expression for the set of users to which the rule applies. The rule will apply to all users who bind with a distinguished name that matches the regular expression.
      You can type the distinguished name directly in the field, or you can click Set to use the Distinguished Name Editor to construct the distinguished name.

    • If you selected Address, specify an IP address.
      The IP address can contain wildcards. The rule will apply to all users who bind from the specified IP address.

    • If you selected Domain, specify a domain name.
      The domain name can contain wildcards. The rule will apply to all users who bind from the specified domain.

    • If you selected Member Attribute, specify an attribute.
      The rule will allow the DN used in the bind to be added to or removed from the list of members specified by the attribute. The rule will apply to all users whose directory entries contain this attribute.

  6. Specify the access rights to be granted to the specified set of users.

  7. Click Apply to add the rule.
    You can now define other rules for entries you have selected. When you have created all the rules for these entries, click Cancel to dismiss the Add Access Rule window.

  8. In the Create Access Control Rule window, click OK to store the new rules.
    Now select another set of entries and define access controls for them, as described in Step 3.
    Configuration changes are implemented when you restart the dsservd daemon.


Modifying an Access Control Rule

  1. Click on Access Control in the Sections list to display the Access Control screen.

  2. In the Access Control section of the screen select the rule you want to modify, and select Modify ACL from the Selected option button.
    The Modify Access Control Rule window is displayed.
    Alternatively, double-click on a rule to display the Modify Access Control Rule window.

  3. Select the rule that you want to modify, and choose Modify Access Rule from the Selected option button.
    The Modify User Rule window is displayed.
    If you double-click the rule you want to modify, the Modify User Rule window is displayed automatically.

  4. When you have finished modifying the rule, click Apply.
    Make any other modifications you require. When you have made all the modifications, click Cancel to dismiss the Modify User Rule window.

  5. Click OK in the Modify access Control Window.
    These changes will take effect when you restart the dsservd daemon.


Deleting an Access Control Rule

To delete a set of access control rules:
  1. Click on Access Control in the Sections list to display the Access Control screen.

  2. In the Access Control section of the screen select the rule you want to delete (a set of access control rules features a folder icon and the text Access to ), and select Delete ACL from the Selected option button.
    You are prompted to confirm that you want to delete the set of access control rules.

To delete one rule from a set of access control rules:
  1. Click on Access Control in the Sections list to display the Access Control screen.

  2. In the Access Control section of the screen open the folder of the set of access control rules from which you want to delete a rule.
    The list of access rules in the set is displayed.

  3. Select the rule you want to delete, and select Delete ACL from the Selected option button.
    You are prompted to confirm that you want to delete the access control rule.


Reordering Access Control Rules

  1. Click on Access Control in the Sections list to display the Access Control screen.

  2. Select the rule you want to move, and click on the Move Up or Move Down button.

  3. When the rules are reordered, click Apply to save the changes to the configuration file. The changes are implemented when you restart the dsservd daemon.

    Note - The Admin Console will prevent you from breaking the convention of placing the rules from the more specific to the more general.


Specifying Default Access Control

You can specify a background level of access control to apply in cases where access control rules haven't been defined. For example, you may want specific access control rules for some entries in the directory, and all other entries to be read only.
  1. Click on Access Control in the Sections list to display the Access Control screen.

  2. Select the default access control rule with the Default Access option button.


 
 
© Copyright 1998 Sun Microsystems, Inc.
901 San Antonio Road, Palo Alto, California 94303 U.S.A.