Using Get Effective Rights From The Console - Red Hat DIRECTORY SERVER 7.1 - ADMINISTRATOR Administrator's Manual

Viewing the ACIs for an Entry
./ldapsearch -p 389 -h localhost -D
"uid=dmiller,ou=people,dc=example,dc=com" -w password -b
"uid=tmorris,ou=people,dc=example,dc=com" -J
"1.3.6.1.4.1.42.2.27.9.5.2:true:dn:
uid=tmorris,ou=people,dc=example,dc=com" "(objectClass=*)"
ldap_search: Insufficient access
ldap_search: additional info: get-effective-rights: requestor
has no g permission on the entry
However, Ted Morris could run a get effective rights search on his personal entry
to determine the rights another user, such as Sam Carter, has to it. Assuming that
an
ldapsearch
uid=tmorris,ou=people,dc=example,dc=com
uid=scarter,ou=people,dc=example,dc=com
the following effective rights information:
entryLevelRights: v
attributeLevelRights: givenName:rsc, sn:rsc, ou:rsc, l:rsc,
manager:rsc, roomNumber:rsc, mail:rsc,
facsimileTelephoneNumber:rsc, objectClass:rsc, uid:rsc, cn:rsc,
userPassword:none
This means that Sam Carter has the right to view the DN of the entry and to read,
search, and compare the
the
userPassword

Using Get Effective Rights from the Console

To view effective rights from the Console, do the following:
Open the Directory tab, and right-click on the entry which rights you want to
1.
check.
Select "Advanced Properties" from the drop-down menu.
2.
The Properties Editor will appear.
Check the "Show effective rights" checkbox.
3.
The attribute-level effective rights (
attributes. The entry-level rights (
the entry in the lower left-hand corner of the Properties Editor.
If you check the "Show all allowed attributes" checkbox, then the effective rights
for those attributes will appear next to the additional attributes, even though they
do not have values.
268 Red Hat Directory Server Administrator's Guide • May 2005
was run with set to
-b
,
ou givenName
attribute.
and the
AuthId
, then Ted Morris would retrieve
, , and other attributes and no rights to
l
, , , , ) will appear next to the
r s c w o
, , , ) will appear under the full DN for
v a d n
was set to