Providing Temporary Access

Without changing your basic configuration, you can allow temporary access to a remote user whose entry is in a different naming context.

1. In the Dynamic section of the USERS table, add a BaseDN and FILTER token to the configuration with the prefix TMP_ , and assign temporary values, using the following format:

   TMP_BASEDN = new_search_baseTMP_Filter = (&(Objectclass=remoteUser)(uid=$UserID)(uid=userid))

   where:

   • new_search_base is the naming context that holds the remoteUser entry for the person to whom you are granting temporary access. If this naming context is stored on a different server, ensure that a referral is defined between the two servers

   • userid is the actual userid of the remote user. This ensures that you grant access to that user alone, and not to all the entries with the object class remoteUser in the new search base

2. Restart the dsradiusd daemon so that the new configuration file is taken into account.

   # /opt/SUNWconn/ldap/sbin/dsradius stop
   # /opt/SUNWconn/ldap/sbin/dsradius start

   For example, if your Base DN for remote users is l=Paris, o=XYZ, c=US, and you want to provide temporary access to the remote user Felipe Gonzalez located in Madrid, you would change the local radius.mapping file to include:

   BaseDN= l=Paris, o=xyz, c=us
   TMP_BaseDN= l=Madrid, o=xyz, c=us
   FILTER=(&(Objectclass=remoteUser)(uid=$UserID))
   TMP_Filter=(&(Objectclass=remoteUser)(uid=$UserID)(uid=fgonzalez))

   This example assumes that a referral exists between the local directory server and the directory server holding the naming context l=Madrid, o=XYZ, c=US.

   If you want to temporarily extend permission to all remote users within the XYZ corporation, you would use the following temporary base DN token:

   TMP_BaseDN= o=xyz, c=us

   This example assumes that there is a default referral from the server that holds the l=Paris, o=XYZ, c=US data store to the server that holds the o=XYZ, c=US data store. It also assumes that the o=XYZ, c=US data store contains referral entries to all data stores held on other servers.