Red Hat DIRECTORY SERVER 8.1 - DEPLOYMENT Deployment Manual page 137

attributes that are targeted or by explicitly naming the attributes that are not targeted by the ACI.
Excluding attributes in the target sets a permission for all but a few attributes allowed by an object
class structure.
8.7.1.2. Permissions
Permissions can either allow or deny access. In general, avoid denying permissions (for the reasons
Section 8.7.2.2, "Allowing or Denying
explained in
performed on the directory service:
Permission
Read
Write
Search
Compare
Self-write
Add
Delete
Access"). Permissions can be any operation
Description
Indicates whether directory data may be read.
Indicates whether directory data may be changed
or created. This permission also allows directory
data to be deleted but not the entry itself. To
delete an entire entry, the user must have delete
permissions.
Indicates whether the directory data can be
searched. This differs from the read permission
in that read allows directory data to be viewed if it
is returned as part of a search operation.
For example, if searching for common names is
allowed as well as read permission for a person's
room number, then the room number can be
returned as part of the common name search,
but the room number itself cannot be used as
the subject of a search. Use this combination to
prevent people from searching the directory to
see who sits in a particular room.
Indicates whether the data may be used
in comparison operations. The compare
permission implies the ability to search, but
actual directory information is not returned as a
result of the search. Instead, a simple Boolean
value is returned which indicates whether the
compared values match. This is used to match
userPassword attribute values during directory
authentication.
Used only for group management. This
permission enables a user to add to or delete
themselves from a group.
Indicates whether child entries can be created.
This permission enables a user to create child
entries beneath the targeted entry.
Indicates whether an entry can be deleted. This
permission enables a user to delete the targeted
entry.
About the ACI Format
127