Red Hat DIRECTORY SERVER 8.1 - DEPLOYMENT Deployment Manual

Also see for 8.1: Installation guide Release note Using instruction Reference Using instructions

Contents

Red Hat DIRECTORY SERVER 8.1 - DEPLOYMENT Deployment Manual Manual pdf 140 page image

Chapter 8. Designing a Secure Directory130For example, to make sure that Mail Administrators do not allow write access to the common nameattribute, then set an ACI that explicitly denies write access to the common name attribute.8.7.2.4. Where to Place Access Control RulesAccess control rules can be placed on any entry in the directory. Often, administrators place accesscontrol rules on entries with the object classes domainComponent, country, organization,organizationalUnit, inetOrgPerson, or group.Organize rules into groups as much as possible in order to simplify ACL administration. Rulesgenerally apply to their target entry and to all of that entry's children. Consequently, it is best to placeaccess control rules on root points in the directory or on directory branch points, rather than scatterthem across individual leaf (such as person) entries.8.7.2.5. Using Filtered Access Control RulesOne of the more powerful features of the Directory Server ACI model is the ability to use LDAP searchfilters to set access control. Use LDAP search filters to set access to any directory entry that matchesa defined set of criteria.For example, allow read access for any entry that contains an organizationalUnit attribute that isset to Marketing.Filtered access control rules allow predefined levels of access. Suppose the directory contains homeaddress and telephone number information. Some people want to publish this information, whileothers want to be unlisted. There are several ways to address that:• Create an attribute on every user's directory entry called publishHomeContactInfo.• Set an access control rule that grants read access to the homePhone and homePostalAddressattributes only for entries whose publishHomeContactInfo attribute is set to true (meaningenabled). Use an LDAP search filter to express the target for this rule.• Allow the directory users to change the value of their own publishHomeContactInfo attribute toeither true or false. In this way, the directory user can decide whether this information is publiclyavailable.For more information about using LDAP search filters and on using LDAP search filters with ACIs,refer to the Red Hat Directory Server Administrator's Guide.8.7.3. Viewing ACIs: Get Effective RightsIt can be necessary to view access controls set on an entry to grant fine-grained access control or forefficient entry management. Get effective rights is an extended ldapsearch which returns the accesscontrol permissions set on each attribute within an entry, and allows an LDAP client to determine whatoperations the server's access control configuration allows a user to perform.The access control information is divided into two groups of access: rights for an entry and rightsfor an attribute. "Rights for an entry" means the rights, such as modify or delete, that are limited tothat specific entry. "Rights for an attribute" means the access right to every instance of that attributethroughout the directory.This kind of detailed access control may be necessary in the following types of situations: