Granting Conditional Access To A Group Or Role - Netscape DIRECTORY SERVER 6.2 - ADMINISTRATOR Administrator's Manual

Access Control Usage Examples

Granting Conditional Access to a Group or Role

In many cases, when you grant a group or role privileged access to the directory,
you want to ensure that those privileges are protected from intruders trying to
impersonate your privileged users. Therefore, in many cases, access control rules
that grant critical access to a group or role are often associated with a number of
conditions.
example.com
of its hosted companies, HostedCompany1 and HostedCompany2. It wants
these companies to be able to manage their own data and implement their own
access control rules while securing it against intruders. For this reason,
HostedCompany1 and HostedCompany2 have full rights on their respective
branches of the directory tree, provided the following conditions are fulfilled:
• Connection authenticated using SSL,
• Access requested between 8 am and 6 pm, Monday through Thursday, and
• Access requested from a specified IP address for each company.
These conditions are illustrated in a single ACI for each company, ACI
"HostedCompany1" and ACI "HostedCompany2". Because the content of these
ACIs is the same, the examples below illustrate the "HostedCompany1 " ACI only.
ACI "HostedCompany1"
In LDIF, to grant HostedCompany1 full access to their own branch of the directory
under the conditions stated above, you would write the following statement:
aci:
(target="ou=HostedCompany1,ou=corporate-clients,dc=example,dc=com
")
(targetattr= "*") (version 3.0; acl "HostedCompany1";
allow (all) (roledn="ldap:///cn=DirectoryAdmin,ou=HostedCompany1,
ou=corporate-clients, dc=example,dc=com") and (authmethod="ssl")
and
(dayofweek="Mon,Tues,Wed,Thu") and (timeofday >= "0800" and
timeofday <= "1800") and (ip="255.255.123.234"); )
This example assumes that the ACI is added to the
ou=corporate-clients,dc=example,dc=com
From the Console, you can set this permission by doing the following:
In the Directory tab, right click the HostedCompany1 entry under the
1.
example.com
Permissions from the pop-up menu to display the Access Control Manager.
Click New to display the Access Control Editor.
2.
248 Netscape Directory Server Administrator's Guide • December 2003
, for example, has created a Directory Administrator role for each
node in the left navigation tree, and choose Set Access
ou=HostedCompany1,
entry.