Where To Place Access Control Rules; Using Filtered Access Control Rules - Netscape DIRECTORY SERVER 6.1 - DEPLOYMENT Deployment Manual

Designing Access Control
If you are allowing a person or group of people to manage some part of the
directory tree, but you want to make sure that they do not modify some aspect
of the tree, use an explicit deny. For example, if you want to make sure the Mail
Administrators do not allow write access to the common name attribute, then
set an ACI that explicitly denies write access to the common name attribute.

Where to Place Access Control Rules

Access control rules can be placed on any entry in the directory. Often
administrators place access control rules on entries of type
organization
To simplify your ACL administration, group your rules as much as possible. Since
a rule generally applies to its target entry and to all that entry's children, it is best to
place access control rules on root points in the directory or on directory branch
points, rather than scatter them across individual leaf (such as person) entries.

Using Filtered Access Control Rules

One of the more powerful features of the Directory Server ACI model is the ability
to use LDAP search filters to set access control. LDAP search filters allows you to
set access to any directory entry that matches a defined set of criteria.
For example, you could allow read access for any entry that contains an
organizationalUnit
Filtered access control rules let you use predefine levels of access. For example,
suppose your directory contains home address and telephone number information.
Some people want to publish this information, while others want to be "unlisted."
You can handle this situation by doing the following:
• Create an attribute on every user's directory entry called
publishHomeContactInfo
• Set an access control rule that grants read access to the
homePostalAddress
publishHomeContactInfo
LDAP search filter to express the target for this rule.
• Allow your directory users to change the value of their own
publishHomeContactInfo
directory user can decide whether this information is publicly available.
For more information about using LDAP search filters, and on using LDAP search
filters with ACIs, see the Netscape Directory Server Administrator's Guide.
152 Netscape Directory Server Deployment Guide • August 2002
,
organizationalUnit
attribute that is set to Marketing.
.
attributes only for entries whose
attribute is set to TRUE (meaning enabled). Use an
attribute to either TRUE or FALSE. In this way, the
, , or
inetOrgPerson
,
country
.
group
and
homePhone