Table of Contents
Advertisement
Creating and Maintaining Database Links
NOTE
Add the local proxy authorization ACI to the
c=africa,ou=people,dc=example,dc=coml
aci:(targetattr="*")(target="l=Zanzibar,c=africa,ou=people,
dc=example,dc=com")(version 3.0; acl "Proxied authorization for
database links"; allow (proxy) userdn = "ldap:///cn=server1 proxy
admin,cn=config";)
Then add the local client ACI that will allow the client operation to succeed on
server two given that ACI checking is turned on. This ACI is the same as the ACI
you will create on the destination server to provide access to the
l=Zanzibar,c=africa,ou=people,dc=example,dc=com
that you want all users within
update access to the entries in
l=Zanzibar,c=africa,ou=people,dc=example,dc=com
following ACI is the ACI you would need to create on the
c=africa,ou=people,dc=example,dc=com
aci:(targetattr="*")(target="l=Zanzibar,c=africa,ou=people,
dc=example,dc=com")(version 3.0; acl "Client authorization for
database links"; allow (all) userdn =
"ldap:///uid=*,c=us,ou=people,dc=example,dc=com";)
This ACI allows clients that have a uid in
on server one to perform any type of operation on the
l=Zanzibar,c=africa,ou=people,dc=example,dc=com
three. Should you have users on server two under a different suffix that will
require additional rights on server three, you may need to add additional client
ACIs on server two.
Configuring Server Three
The final configuration step in our cascading chaining example is to configure
server three. First, you create an administrative user on server three for server two
to use for proxy authorization:
128
Netscape Directory Server Administrator's Guide • January 2002
To create these ACIs it is assumed that the database corresponding
to the
c=africa,ou=people,dc=example,dc=com
exists to hold the entry. This database needs to be associated with a
suffix above the suffix specified in the
each database link. That is, the suffix on the final destination server
should be a sub suffix of the suffix specified on the intermediate
server.
c=us,ou=people,dc=example,dc=com
nsslapd-suffix
entry:
branch. You may decide
on server three. The
suffix on server two to allow this:
c=us,ou=people,dc=example,dc=com
suffix tree on server
suffix already
attribute of
to have
Advertisement
Table of Contents
