Using Acis: Some Hints And Tricks - Netscape DIRECTORY SERVER 6.1 - DEPLOYMENT Deployment Manual

Using ACIs: Some Hints and Tricks

The following are some ideas that you should keep in mind when you implement
your security policy. They can help to lower the administrative burden of
managing your directory security model and improve your directory's
performance characteristics.
Some of the following hints have already been described earlier in this chapter.
They are included here to provide you with a complete list.
• Minimize the number of ACIs in your directory.
Although Directory Server can evaluate over 50,000 ACIs, it is difficult to
manage a large number of ACI statements. A large number of ACIs makes it
hard for you to determine immediately the directory object available to
particular clients.
Directory Server 6.1 provides a new feature that minimizes the number of ACIs
in the directory by using macros. Macros are placeholders that are used to
represent a DN, or a portion of a DN, in an ACI. You can use the macro to
represent a DN in the target portion of the ACI, or in the bind rule portion, or
both. For more information on macro ACIs, refer to "Managing Access
Control" in the Netscape Directory Server Administrator's Guide.
• Balance allow and deny permissions.
Although the default rule is to deny access to any user who has not been
specifically granted access, you might find that you can save on the number of
ACIs by using one ACI allowing access close to the root of the tree, and a small
number of deny ACIs close to the leaf entries. This scenario can avoid the use
of multiple allow ACIs close to the leaf entries.
• Identify the smallest set of attributes on any given ACI.
This means that if you are allowing or restricting access to a subset of attributes
on an object, determine whether the smallest list is the set of attributes that are
allowed or the set of attributes that are denied. Then express your ACI so that
you are managing the smallest list.
For example, the people object class contains dozens of attributes. If you want
to allow a user to update just one or two of these attributes, then write your
ACI so that it allows write access for just those few attributes. If, however, you
want to allow a user to update all but one or two attributes, then create the ACI
so that it allows write access for everything but a few named attributes.
• Use LDAP search filters cautiously.
Designing Access Control
Chapter 7 Designing a Secure Directory 153