| Exit Print View | |
Sun OpenDS Standard Edition 2.0 Administration Guide |
|
|
|
Configuring the Directory Server
Configuring Security in the Directory Server
Managing Global ACIs With dsconfig
Granting Write Access to Personal Entries
Granting a Group Full Access to a Suffix
Granting Rights to Add and Delete Group Entries
Allowing Users to Add or Remove Themselves From a Group
Granting Conditional Access to a Group
Defining Permissions for DNs That Contain a Comma
The Get Effective Rights Control
Using the Get Effective Rights Control
Understanding Effective Rights Results
ACIs are stored as one or more values of the aci attribute on an entry. The aci attribute is a multivalued operational attribute that can be read and modified by directory users, and should itself be protected by ACIs.
Administrative users are usually given full access to the aci attribute.
$ ldapsearch -h host -p port -D "cn=Directory Manager" -w password \ -b entryDN -s base "(objectclass=*)" aci
The result is LDIF text that you can copy into a new LDIF ACI definition for editing. Because the value of an ACI is a long string, the output from the ldapsearch operation is likely to be displayed over several lines, with the first space being a continuation marker. Take this into account when copying and pasting the LDIF output.
To view the effect of an ACI value, in terms of the permissions that it grants or denies, see Viewing Effective Rights.
|
|