Denying Access - Netscape DIRECTORY SERVER 6.2 - ADMINISTRATOR Administrator's Manual

Access Control Usage Examples
"ldap:///cn=DirectoryAdmin,ou=HostedCompany1,ou=corporate-cli
ents, dc=example,dc=com") and (dayofweek="Mon,Tues,Wed,Thu")
and (timeofday >= "0800" and timeofday <= "1800") and
(ip="255.255.123.234") and (authmethod="ssl"); )
Click OK.
9.
The new ACI is added to the ones listed in the Access Control Manager
window.

Denying Access

If your directory holds business-critical information, you might specifically want to
deny access to it.
For example,
information such as connection time or account balance under their own
entries, but explicitly wants to deny write access to that information. This is
illustrated in ACI "Billing Info Read" and ACI "Billing Info Deny" respectively.
ACI "Billing Info Read"
In LDIF, to grant subscribers permission to read billing information in their own
entry, you would write the following statement:
aci: (targetattr="connectionTime || accountBalance") (version 3.0;
acl "Billing Info Read"; allow (search,read) userdn=
"ldap:///self";)
This example assumes that the relevant attributes have been created in the schema,
and that the ACI is added to the
From the Console, you can set this permission by doing the following:
In the Directory tab, right click the subscribers entry under the
1.
node in the left navigation tree, and choose Set Access Permissions from the
pop-up menu to display the Access Control Manager.
Click New to display the Access Control Editor.
2.
In the Users/Groups tab, in the ACI name field, type "Billing Info Read". In the
3.
list of users granted access permission, do the following:
a.
b.
250 Netscape Directory Server Administrator's Guide • December 2003
wants all subscribers to be able to read billing
example.com
Select and remove All Users, then click Add.
The Add Users and Groups dialog box is displayed.
Set the Search area in the Add Users and Groups dialog box to to Special
Rights, and select Self from the Search results list.
ou=subscribers,dc=example,dc=com
entry.
example.com