Exit Print View

Sun OpenDS Standard Edition 2.2 Administration Guide

Get PDF Book Print View

Document Information

Before You Start

Starting and Stopping Your Server Instance

Configuring the Server Instance

Configuring the Proxy Components

Configuring Security Between Clients and Servers

Configuring Security Between the Proxy and the Data Source

Configuring Servers With the Control Panel

Managing Directory Data

Replicating Directory Data

Controlling Access To Data

Managing Global ACIs With dsconfig

Default Global ACIs

To Display the Global ACIs

To Delete a Global ACI

To Add a Global ACI

Managing ACIs With ldapmodify

To View ACI Attribute Values

To Add an ACI

To Remove an ACI

Access Control Usage Examples

Disabling Anonymous Access

Granting Write Access to Personal Entries

Granting a Group Full Access to a Suffix

Granting Rights to Add and Delete Group Entries

Allowing Users to Add or Remove Themselves From a Group

Granting Conditional Access to a Group

Denying Access

Defining Permissions for DNs That Contain a Comma

Proxy Authorization ACIs

Viewing Effective Rights

The Get Effective Rights Control

Using the Get Effective Rights Control

Understanding Effective Rights Results

Restricting Access to the Get Effective Rights Control

Managing Users and Groups

Monitoring Sun OpenDS Standard Edition

Improving Performance

Advanced Administration

To Add an ACI

You can add an ACI by specifying the ACI in an LDIF file and then applying the LDIF file with the ldapmodify command. The LDIF file must contain one or more aci attributes, each of which is composed of the aci: prefix followed by the ACI specification. For more information, see ACI Syntax in Sun OpenDS Standard Edition 2.2 Architectural Reference.

  1. Create the ACI in an LDIF file.

    The following sample LDIF file (aci.ldif) adds an ACI that grants a particular user (csmith) full access rights to the directory:

    dn: ou=people,dc=example,dc=com
    changetype: modify
    add: aci
    aci: (targetattr="*")(version 3.0; acl "give csmith full rights"; allow(all)
    userdn =  "ldap:///uid=csmith,ou=People,dc=example,dc=com";)
  2. Use the ldapmodify command to apply the ACI to the directory.

    The following command applies the ACI contained in the aci.ldif file to the directory:

    $ ldapmodify -h localhost -p 1389 -D "cn=Directory Manager" -w password \
      --filename aci.ldif
    Processing MODIFY request for ou=people,dc=example,dc=com
    MODIFY operation successful for DN ou=people,dc=example,dc=com