Granting Conditional Access To A Group Or Role; Aci "Hostedcompany1 - Red Hat DIRECTORY SERVER 7.1 - ADMINISTRATOR Administrator's Manual

Granting Conditional Access to a Group or Role

In many cases, when you grant a group or role privileged access to the directory,
you want to ensure that those privileges are protected from intruders trying to
impersonate your privileged users. Therefore, in many cases, access control rules
that grant critical access to a group or role are often associated with a number of
conditions.
, for example, has created a Directory Administrator role for each of
example.com
its hosted companies,
companies to be able to manage their own data and implement their own access
control rules while securing it against intruders. For this reason,
and
HostedCompany2
tree, provided the following conditions are fulfilled:
• Connection authenticated using SSL,
• Access requested between 8 a.m. and 6 p.m., Monday through Thursday, and
• Access requested from a specified IP address for each company.
These conditions are illustrated in a single ACI for each company, ACI
"HostedCompany1" and ACI "HostedCompany2." Because the content of these
ACIs is the same, the examples below illustrate the "HostedCompany1" ACI only.

ACI "HostedCompany1"

In LDIF, to grant HostedCompany1 full access to their own branch of the directory
under the conditions stated above, you would write the following statement:
aci:
(target="ou=HostedCompany1,ou=corporate-clients,dc=example,dc=co
m")
(targetattr= "*") (version 3.0; acl "HostedCompany1";
allow (all)
(roledn="ldap:///cn=DirectoryAdmin,ou=HostedCompany1,
ou=corporate-clients, dc=example,dc=com") and (authmethod="ssl")
and
(dayofweek="Mon,Tues,Wed,Thu") and (timeofday >= "0800" and
timeofday <= "1800") and (ip="255.255.123.234"); )
This example assumes that the ACI is added to the
ou=corporate-clients,dc=example,dc=com
From the Console, you can set this permission by doing the following:
and
HostedCompany1
have full rights on their respective branches of the directory
Access Control Usage Examples
. It wants these
HostedCompany2
HostedCompany1
ou=HostedCompany1,
entry.
Chapter 6 Managing Access Control 255