Aci Placement; Aci Evaluation - Red Hat DIRECTORY SERVER 7.1 - ADMINISTRATOR Administrator's Manual

Access Control Principles

ACI Placement

If an entry containing an ACI does not have any child entries, the ACI applies to
that entry only. If the entry has child entries, the ACI applies to the entry itself and
all entries below it. As a direct consequence, when the server evaluates access
permissions to any given entry, it verifies the ACIs for every entry between the one
requested and the directory suffix, as well as the ACIs on the entry itself.
The attribute is multi-valued, which means that you can define several ACIs
aci
for the same entry or subtree.
You can create an ACI on an entry that does not apply directly to that entry but to
some or all of the entries in the subtree below it. The advantage of this is that you
can place at a high level in the directory tree a general ACI that effectively applies
to entries more likely to be located lower in the tree. For example, at the level of an
entry or a entry, you could create an ACI that
organizationalUnit locality
targets entries that include the object class.
inetorgperson
You can use this feature to minimize the number of ACIs in the directory tree by
placing general rules at high level branch points. To limit the scope of more specific
rules, you should place them as close as possible to leaf entries.
NOTE ACIs placed in the root DSE entry apply only to that entry.

ACI Evaluation

To evaluate the access rights to a particular entry, the server compiles a list of the
ACIs present on the entry itself and on the parent entries back up to the top level
entry stored on the Directory Server. ACIs are evaluated across all of the databases
for a particular Directory Server but not across Directory Servers.
The evaluation of this list of ACIs is done based on the semantics of the ACIs, not
on their placement in the directory tree. This means that ACIs that are close to the
root of the directory tree do not take precedence over ACIs that are closer to the
leaves of the directory tree.
The precedence rule that applies is that ACIs that deny access take precedence over
ACIs that allow access. Between ACIs that allow access, union semantics apply, so
there is no precedence.
Chapter 6 Managing Access Control 203