Granting A Group Full Access To A Suffix - Netscape DIRECTORY SERVER 6.1 - ADMINISTRATOR Administrator's Manual

Access Control Usage Examples
c.
d.
On the Rights tab, tick the checkbox for write. Make sure the other checkboxes
4.
are clear.
On the Hosts tab, click Add to display the Add Host Filter dialog box. In the
5.
DNS host filter field, type
To create the value-based filter for roles, switch to manual editing by clicking
6.
the Edit Manually button. Add the following to the beginning of the LDIF
statement:
(targattrfilters="add=nsRoleDN:(nsRoleDN != "cn=superAdmin,
dc=example,dc=com")")
The LDIF statement should read as follows:
(targattrfilters="add=nsRoleDN:(nsRoleDN != "cn=superAdmin,
dc=example,dc=com")") (targetattr = "*") (target =
"ldap:///dc=example,dc=com") (version 3.0; acl "Roles"; allow
(write) (userdn = "ldap:///self") and (dns="*.example.com");)
Click OK.
7.
The new ACI is added to the ones listed in the Access Control Manager
window.

Granting a Group Full Access to a Suffix

Most directories have a group that is used to identify certain corporate functions.
These groups can be given full access to all or part of the directory. By applying the
access rights to the group, you can avoid setting the access rights for each member
individually. Instead, you grant users these access rights simply by adding them to
the group.
For example, when you install the Directory Server using the Typical Install
process, an Administrators group with full access to the directory is created by
default.
At
example.com
ou=example-people
database. This is illustrated in the ACI "HR" example.
ACI "HR"
In LDIF, to grant the HR group all rights on the employee branch of the directory,
you would use the following statement:
242 Netscape Directory Server Administrator's Guide • August 2002
Click the Add button to list Self in the list of users who are granted access
permission.
Click OK to dismiss the Add Users and Groups dialog box.
, the Human Resources group is allowed full access to the
branch of the directory so that they can update the employee
. Click OK to dismiss the dialog box.
*.example.com