Red Hat DIRECTORY SERVER 8.0 - ADMINISTRATION Administration Manual page 5

5.3.4. Deleting Views from the Command Line .......................................................... 139
5.4. Using Groups ........................................................................................................... 140
5.4.1. Managing Static Groups ................................................................................. 140
5.4.2. Managing Dynamic Groups ............................................................................ 141
6. Managing Access Control
6.1. Access Control Principles .......................................................................................... 143
6.1.1. ACI Structure ................................................................................................. 143
6.1.2. ACI Placement .............................................................................................. 143
6.1.3. ACI Evaluation ............................................................................................... 144
6.1.4. ACI Limitations .............................................................................................. 144
6.2. Default ACIs ............................................................................................................. 145
6.3. Creating ACIs Manually ............................................................................................ 146
6.3.1. The ACI Syntax ............................................................................................. 146
6.3.2. Defining Targets ............................................................................................. 147
6.3.3. Defining Permissions ..................................................................................... 152
6.4. Bind Rules ............................................................................................................... 156
6.4.1. Bind Rule Syntax ........................................................................................... 156
6.4.2. Defining User Access - userdn Keyword .......................................................... 157
6.4.3. Defining Group Access - groupdn Keyword ..................................................... 160
6.4.4. Defining Role Access - roledn Keyword ........................................................... 161
6.4.5. Defining Access Based on Value Matching ...................................................... 161
6.4.6. Defining Access from a Specific IP Address .................................................... 166
6.4.7. Defining Access from a Specific Domain ......................................................... 167
6.4.8. Defining Access at a Specific Time of Day or Day of Week ............................... 167
6.4.9. Defining Access Based on Authentication Method ............................................ 169
6.4.10. Using Boolean Bind Rules ............................................................................ 170
6.5. Creating ACIs from the Console ................................................................................ 170
6.5.1. Displaying the Access Control Editor ............................................................... 171
6.5.2. Creating a New ACI ....................................................................................... 173
6.5.3. Editing an ACI ............................................................................................... 178
6.5.4. Deleting an ACI ............................................................................................. 179
6.6. Viewing ACIs ............................................................................................................ 179
6.7. Get Effective Rights Control ...................................................................................... 179
6.7.1. Using Get Effective Rights from the Command-Line ......................................... 181
6.7.2. Using Get Effective Rights from the Console ................................................... 183
6.7.3. Get Effective Rights Return Codes .................................................................. 183
6.8. Logging Access Control Information ........................................................................... 184
6.9. Access Control Usage Examples ............................................................................... 184
6.9.1. Granting Anonymous Access .......................................................................... 185
6.9.2. Granting Write Access to Personal Entries ...................................................... 187
6.9.3. Restricting Access to Key Roles ..................................................................... 189
6.9.4. Granting a Group Full Access to a Suffix ......................................................... 191
6.9.5. Granting Rights to Add and Delete Group Entries ............................................ 192
6.9.6. Granting Conditional Access to a Group or Role .............................................. 194
6.9.7. Denying Access ............................................................................................. 195
6.9.8. Setting a Target Using Filtering ....................................................................... 197
6.9.9. Allowing Users to Add or Remove Themselves from a Group ............................ 198
6.9.10. Defining Permissions for DNs That Contain a Comma .................................... 199
6.9.11. Proxied Authorization ACI Example ............................................................... 199
6.10. Advanced Access Control: Using Macro ACIs ........................................................... 200
6.10.1. Macro ACI Example ..................................................................................... 200
143
v