本附录介绍了以下主题:
将 Access Manager 与 Messaging Server 一起安装并使用 LDAP Schema 2 目录时,一开始会在该目录中安装大量访问控制指令 (Access Control Instruction, ACI)。很多默认的 ACI 对 Messaging Server 来说是不需要的或用不到。
由于在运行时需要检查这些 ACI,因此会影响 Directory Server 的性能,从而影响 Messaging Server 的查找操作和其他目录操作的性能。
可以通过合并和精简目录中的默认 ACI 数量来提高 Directory Server 的性能。合并 ACI 还会使它们更易于管理。
精简 ACI 的方法如下:
合并、优化和削减冗余的 ACI
修改 ACI 以使用更简单、更有效的语法
将多个不同的 ACI 合并(在根后缀处)
清除未使用的 ACI
对于具有多个组织的目录,允许分别删除各个组织节点上的组织 ACI。
本附录首先介绍了如何使用 ldif 文件 (replacment.acis.ldif ) 来合并根后缀处的 ACI 并从目录中删除未使用的 ACI。有关详细信息,请参见下面的合并和删除 ACI。
接下来,本附录将分析每个 ACI 并建议一种对其进行处理的方法:通过删除和修改使该 ACI 更有效,或者重写该 ACI。
请注意,这些建议存在以下约束:
最终用户无法访问 Directory 控制台
最终用户无法访问 Access Manager 控制台。
考虑到这些约束,您必须自行确定(根据您的安装要求)是否可以使用 ldif 文件来合并和删除 ACI,或者是否需要保留目录中现有的某些 ACI。
有关详细信息,请参见本附录后面的对现有 ACI 的分析。
然后,本附录将介绍通过 replacement.acis.ldif 文件合并的 ACI。本附录列出了在合并之前现有的 ACI 以及在合并之后经过修改的 ACI。有关详细信息,请参见本附录后面的ACI 合并方式分析。
最后,本附录将列出 replacement.acis.ldif 所放弃的 ACI。有关详细信息,请参见本附录后面的要放弃的未使用的 ACI 列表。
本节列出的 ldif 文件 replacement.acis.ldif 会把合并后的 ACI 安装在根后缀处并从目录中删除未使用的 ACI。此 ldif 文件是由 Delegated Administrator 提供的,位于以下目录中:
da-base/lib/config-templates
使用 ldapmodify 命令将 replacement.acis.ldif 文件应用于目录后,ldapmodify 命令会删除根后缀处的全部 aci 属性实例,并用 replacement.acis.ldif 文件中的 ACI 来替换这些 ACI。
因此,此过程首先会从根后缀处删除全部 ACI,然后用下面列出的一组 ACI 来替换它们。如果目录中包含由其他应用程序(例如 Portal Server)生成的 ACI,则应该将这些 ACI 保存到一个文件中,然后在应用 replacement.acis.ldif 文件之后将这些 ACI 重新应用于目录。
有关使用此 ldif 文件来清理 ACI 的说明,请参见替换 ACI 的步骤。
dn: $rootSuffix changetype: modify replace: aci aci: (targetattr = “*”)(version 3.0; acl “Configuration Administrator”; allow (all) userdn=”ldap:///uid=admin,ou=Administrators,ou=TopologyManagement, o=NetscapeRoot”;) aci: (target=”“ldap:///$rootSuffix”) (targetfilter=(!(objectclass=sunServiceComponent))) (targetattr != “userPassword||passwordHistory ||passwordExpirationTime||passwordExpWarned||passwordRetryCount ||retryCountResetTime||accountUnlockTime||passwordAllowChangeTime”) (version 3.0; acl “anonymous access rights”; allow (read,search,compare) userdn = “ldap:///anyone”; ) aci: (targetattr != “nsroledn||aci||nsLookThroughLimit||nsSizeLimit ||nsTimeLimit||nsIdleTimeout||passwordPolicySubentry||passwordExpiration Time ||passwordExpWarned||passwordRetryCount||retryCountResetTime ||accountUnlockTime||passwordHistory||passwordAllowChangeTime||uid||mem berOf ||objectclass||inetuserstatus||ou||owner||mail||mailuserstatus ||memberOfManagedGroup||mailQuota||mailMsgQuota||mailhost ||mailAllowedServiceAccess||inetCOS||mailSMTPSubmitChannel”) (version 3.0; acl “Allow self entry modification”; allow (write) userdn =”ldap:///self”;) aci: (targetattr != “ aci || nsLookThroughLimit || nsSizeLimit || nsTimeLimit|| nsIdleTimeout”) (version 3.0; acl “Allow self entry read search”; allow(write) userdn =”ldap:///self”;) aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Proxy user rights”; allow (proxy) userdn = “ldap:///cn=puser,ou=DSAME Users, $rootSuffix”; ) aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS special dsame user rights for all under the root suffix”; allow (all) userdn = “ldap:///cn=dsameuser,ou=DSAME Users, $rootSuffix”; ) aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS special ldap auth user rights”; allow (read,search) userdn = “ldap:///cn=amldapuser,ou=DSAME Users, $rootSuffix”; ) aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Top-level admin rights”; allow (all) roledn = “ldap:///cn=Top-level Admin Role, $rootSuffix”; ) aci: (targetattr=”*”) (version 3.0; acl “Messaging Server End User Administrator Read Only Access”; allow (read,search) groupdn=”ldap:///cn=Messaging End User Administrators Group,ou=Groups, $rootSuffix”;) aci: (targetattr=”objectclass || mailalternateaddress || Mailautoreplymode || mailprogramdeliveryinfo || preferredlanguage || maildeliveryoption || mailforwardingaddress || mailAutoReplyTimeout || mailautoreplytextinternal || mailautoreplytext || vacationEndDate || vacationStartDate || mailautoreplysubject || maxPabEntries || mailMessageStore || mailSieveRuleSource || sunUCDateFormat || sunUCDateDeLimiter || sunUCTimeFormat || mailuserstatus || maildomainstatus || nswmextendeduserprefs || pabURI”) (version 3.0; acl “Messaging Server End User Administrator All Access”; allow (all) groupdn = “ldap:///cn=Messaging End User Administrators Group,ou=Groups, $rootSuffix”;) aci: (targetattr = “*”) (version 3.0;acl “Allow Read-Only Access”; allow (read,search,compare) groupdn = “ldap:///cn=Read-Only,ou=Groups, $rootSuffix”;) aci: (target=”ldap:///cn=Organization Admin Role,($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Organization Admin Role access deny”; deny (write,add,delete,compare,proxy) roledn = “ldap:///cn=Organization Admin Role,($dn), $rootSuffix”;) aci: (target=”ldap:///($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “Organization Admin Role access allow read”; allow(read,search) roledn = “ldap:///cn=Organization Admin Role,[$dn], $rootSuffix” ;) aci: (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (entrydn=($dn),$rootSuffix)))) ( targetattr = “*”) (version 3.0; acl “S1IS Organization Admin Role access allow”; allow (all) roledn = “ldap:///cn=Organization Admin Role,[$dn], $rootSuffix”;)
在开始此过程之前,建议您先检查目录中现有的 ACI。您应确定是否可能需要保留任何将被此过程删除的 ACI。
此过程首先会从根后缀处删除全部 ACI,然后用下面列出的一组 ACI 来替换它们。如果目录中包含由 Messaging Server 以外的应用程序生成的 ACI,则应该将这些 ACI 保存到一个文件中,然后在应用 replacement.acis.ldif 文件后将这些 ACI 重新应用于目录。
要获得有关对 Access Manager 和 Messaging Server 生成的现有 ACI 进行分析的帮助,请参见本附录后面的以下几节:
以下过程描述了如何合并根后缀中的 ACI 并删除未使用的 ACI。
保存根后缀上现有的 ACI。
可以使用 ldapsearch 命令,如以下示例所示:
ldapsearch -D “cn=Directory Manager” -w <password> -s base -b <$rootSuffix> aci=* aci ><filename>
其中
<password> 是 Directory Server 管理员的密码。
<$rootSuffix> 是根后缀, 例如 o=usergroup。
<filename> 是所保存 ACI 将写入的文件的名称。
复制并重命名 replacement.acis.ldif 文件。
安装了 Delegated Administrator 后,就会将 replacement.acis.ldif 文件安装在以下目录中:
da-base/lib/config-templates
编辑您的 replacement.acis.ldif 文件副本中的 $rootSuffix 条目。
将根后缀参数 $rootSuffix 更改为您的根后缀(例如 o=usergroup)。$rootSuffix 参数会在 ldif 文件中出现多次;必须将每个实例都替换掉。
使用 LDAP 目录工具 ldapmodify 替换 ACI。
例如,可以运行以下命令:
ldapmodify -D <directory manager> -w <password> -f <replacement.acis.finished.ldif>
其中
<directory manager> 是 Directory Server 管理员的用户名。
<password> 是 Directory Server 管理员的密码。
<replacement.acis.finished.ldif> 是编辑后的 ldif 文件名,该文件用于合并和删除目录中的 ACI。
使用 Delegated Administrator 控制台创建了一个组织后,就在该组织节点上创建了一组 ACI。
由于在上述过程中安装了替换 ACI,因此不需要每个组织上的这些 ACI。您可以通过使用 Access Manager 控制台来防止在每个组织节点上创建 ACI。
作为 amadmin 登录到 AM 控制台。
AM 控制台位于以下 url:
http://< machine name>:<port >/amconsole
其中
<machine name> 是运行 Access Manager 的计算机
<port> 是端口
选择“服务配置”选项卡。
默认情况下将显示“管理配置”页。
在控制台右侧,向下滚动到“动态管理角色 ACI”。
选择并删除“动态管理角色 ACI”文本框中的所有 ACI。
保存编辑后的设置。
本节中的列表显示了在安装 Access Manager 和 Messaging Server 时安装在目录中的 ACI。还介绍了每个 ACI 的功能,并针对 ACI 是否能够保留、合并或放弃提出了建议。
ACI 分为以下几种类别:
-------------------------------------------------------------------------------------------------------------
dn: $rootSuffix # # consolidate # aci: (targetattr != “nsroledn || aci || nsLookThroughLimit || nsSizeLimit || nsTimeLimit || nsIdleTimeout || passwordPolicySubentry || passwordExpirationTime || passwordExpWarned || passwordRetryCount || retryCountResetTime || accountUnlockTime || passwordHistory || passwordAllowChangeTime”) (version 3.0; acl “Allow self entry modification except for nsroledn, aci, resource limit attributes, passwordPolicySubentry and password policy state attributes”; allow (write) userdn =”ldap:///self”;)
操作:合并。
无需自访问此后缀。此 ACI 将被复制;它可以合并到根后缀上的 ACI 自身中。
------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # retain # aci: (targetattr = “*”) (version 3.0; acl “Configuration Administrator”; allow (all) userdn = “ldap:///uid=admin, ou=Administrators, ou=TopologyManagement,o=NetscapeRoot”;)
操作:保留。
此后缀是 "admin" 用户,该用户将通过“通道验证”来验证 slapd-config 实例。如果所有配置是以 Directory Manager 身份使用命令行实用程序执行的,则无需此 ACI。如果某个用户需要以此用户身份验证控制台,则可以将此 ACI 保留在此处。可以删除类似的 ACI。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (targetattr =”*”) (version 3.0;acl “Configuration Administrators Group”; allow (all) (groupdn = “ldap:///cn=Configuration Administrators, ou=Groups, ou=TopologyManagement, o=NetscapeRoot”);)
操作:在所有 DB 后端上执行放弃。
此后缀是“配置管理员”组,当使用控制台来委托服务器管理权限时,该组将具有此权限。
------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (targetattr =”*”) (version 3.0;acl “Directory Administrators Group”; allow (all) (groupdn = “ldap:///cn=Directory Administrators, $rootSuffix”);)
操作:在所有 DB 后端上执行放弃。
此后缀是常见“目录管理员”组权限定义。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (targetattr = “*”) (version 3.0; acl “SIE Group”; allow (all) groupdn = “ldap:///cn=slapd-whater, cn=Sun ONE Directory Server, cn=Server Group, cn=whater.red.iplanet.com, ou=red.iplanet.com, o=NetscapeRoot”;)
操作:在所有 DB 后端上执行放弃。
此后缀是控制台/管理服务器相关组权限定义。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# retain # aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Proxy user rights”; allow (proxy) userdn = “ldap:///cn=puser,ou=DSAME Users,$rootSuffix”; )
操作:保留。
此 ACI 可授予系统用户访问 Access Manager 的权限。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # retain # aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS special dsame user rights for all under the root suffix”; allow (all) userdn = “ldap:///cn=dsameuser,ou=DSAME Users,$rootSuffix”; )
操作:保留。
此 ACI 可授予系统用户访问 Access Manager 的权限。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # retain # aci: (target=”ldap:///$rootSuffix”)(targetattr=”*”)| (version 3.0;acl “S1IS special ldap auth user rights”; allow (read,search) userdn = “ldap:///cn=amldapuser,ou=DSAME Users,$rootSuffix”; )
操作:保留。
此 ACI 可授予系统用户访问 Access Manager 的权限。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///cn=amldapuser,ou=DSAME Users,$rootSuffix”) (targetattr = “*”) (version 3.0; acl “S1IS special ldap auth user modify right”; deny (write) roledn != “ldap:///cn=Top-level Admin Role,$rootSuffix”;)
操作:放弃。
此 ACI 可阻止顶级管理员 ( Top-Level Administrator, TLA) 修改 amldapuser 帐户。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # retain # aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Top-level admin rights”; allow (all) roledn = “ldap:///cn=Top-level Admin Role,$rootSuffix”; )
操作:保留。
此 ACI 可向顶级管理员角色授予访问权限。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (targetattr=”iplanet-am-saml-user || iplanet-am-saml-password”) (targetfilter=”(objectclass=iplanet-am-saml-service)”) (version 3.0; acl “S1IS Right to modify saml user and password”; deny (all) (roledn != “ldap:///cn=Top-level Admin Role,$rootSuffix”) AND (userdn != “ldap:///cn=dsameuser,ou=DSAME Users,$rootSuffix”) AND (userdn != “ldap:///cn=puser,ou=DSAME Users,$rootSuffix”); )
操作:放弃。
此 ACI 可保护 SAML 相关属性。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(!(nsroledn=cn=Top-level Admin Role,$rootSuffix))) (targetattr = “*”) (version 3.0; acl “S1IS Top-level Help Desk Admin Role access allow”; allow (read,search) roledn = “ldap:///cn=Top-level Help Desk Admin Role,$rootSuffix”;)
操作:放弃。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(!(nsroledn=cn=Top-level Admin Role,$rootSuffix))) (targetattr = “userPassword”) (version 3.0; acl “S1IS Top-level Help Desk Admin Role access allow”; allow (write) roledn = “ldap:///cn=Top-level Help Desk Admin Role,$rootSuffix”;)
操作:放弃。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: target=”ldap:///$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix)))) (targetattr = “*”) (version 3.0; acl “S1IS Top-level Policy Admin Role access allow”; allow (read,search) roledn = “ldap:///cn=Top-level Policy Admin Role,$rootSuffix”;)
操作:放弃。
此 ACI 属于顶级策略管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///ou=iPlanetAMAuthService,ou=services,*$rootSuffix”) (targetattr = “*”) (version 3.0; acl “S1IS Top-level Policy Admin Role access Auth Service deny”; deny (add,write,delete) roledn = “ldap:///cn=Top-level Policy Admin Role,$rootSuffix”;)
操作:放弃。
此 ACI 属于顶级策略管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///ou=services,*$rootSuffix”) (targetattr = “*”) (version 3.0; acl “S1IS Top-level Policy Admin Role access allow”; allow (all) roledn = “ldap:///cn=Top-level Policy Admin Role,$rootSuffix”;)
操作:放弃。
此 ACI 属于顶级策略管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=”(objectclass=sunismanagedorganization)”) (targetattr = “sunRegisteredServiceName”) (version 3.0; acl “S1IS Top-level Policy Admin Role access allow”; allow (read,write,search) roledn = “ldap:///cn=Top-level Policy Admin Role,$rootSuffix”;)
操作:放弃。
此 ACI 属于顶级策略管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (targetattr = “*”) (version 3.0; acl “S1IS Deny deleting self”; deny (delete) userdn =”ldap:///self”;)
操作:合并为单个自写 ACI。由于最终用户不具有删除任何条目(包括其自身)的权限,因此无需显式拒绝。
这是若干用于设置自身权限的 ACI 之一。显式拒绝可阻止任何条目删除其自身。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (targetattr = “objectclass || inetuserstatus || iplanet-am-user-login-status || iplanet-am-web-agent-access-allow-list || iplanet-am-domain-url-access-allow || iplanet-am-web-agent-access-deny-list || iplanet-am-user-account-life || iplanet-am-session-max-session-time || iplanet-am-session-max-idle-time || iplanet-am-session-get-valid-sessions || iplanet-am-session-destroy-sessions || iplanet-am-session-add-session-listener-on-all-sessions || iplanet-am-user-admin-start-dn || iplanet-am-auth-post-login-process-class”) (targetfilter=(!(nsroledn=cn=Top-level Admin Role,$rootSuffix))) (version 3.0; acl “S1IS User status self modification denied”; deny (write) userdn =”ldap:///self”;)
操作:合并为单个自写 ACI。
这是若干用于设置自写权限的 ACI 之一。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (targetattr != “iplanet-am-static-group-dn || uid || nsroledn || aci || nsLookThroughLimit || nsSizeLimit || nsTimeLimit || nsIdleTimeout || memberOf || iplanet-am-web-agent-access-allow-list || iplanet-am-domain-url-access-allow || iplanet-am-web-agent-access-deny-list”) (version 3.0; acl “S1IS Allow self entry modification except for nsroledn, aci, and resource limit attributes”; allow (write) userdn =”ldap:///self”;)
操作:合并为单个自写 ACI。
这是若干用于设置权限的 ACI 之一。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (targetattr != “aci || nsLookThroughLimit || nsSizeLimit || nsTimeLimit || nsIdleTimeout || iplanet-am-domain-url-access-allow”) (version 3.0; acl “S1IS Allow self entry read search except for nsroledn, aci, resource limit and web agent policy attributes”; allow (read,search) userdn =”ldap:///self”;)
操作:合并为单个自写 ACI。
这是若干用于设置自写权限的 ACI 之一。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (target=”ldap:///ou=services,$rootSuffix”) (targetfilter=(!(objectclass=sunServiceComponent))) (targetattr = “*”) (version 3.0; acl “S1IS Services anonymous access”; allow (read, search, compare) userdn = “ldap:///anyone”;)
操作:合并为单个匿名 ACI。
这是若干用于授予匿名权限的 ACI 之一。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (target=”ldap:///ou=iPlanetAMAdminConsoleService,*,$rootSuffix”) (targetattr = “*”) (version 3.0; acl “S1IS iPlanetAMAdminConsoleService anonymous access”; allow (read, search, compare) userdn = “ldap:///anyone”;)
操作:合并为单个匿名 ACI。
这是若干用于授予匿名权限的 ACI 之一。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(entrydn=$rootSuffix)) (targetattr=”*”) (version 3.0; acl “S1IS Default Organization delete right denied”; deny (delete) userdn = “ldap:///anyone”; )
操作:放弃。
此 ACI 可阻止任何用户(rootdn 除外)删除默认组织。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///cn=Top-level Admin Role,$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Top-level admin delete right denied”; deny(delete) userdn = “ldap:///anyone”; )
操作:放弃。
此 ACI 可阻止任何用户(rootdn 除外)删除顶级管理员角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (targetattr = “*”) (version 3.0; acl “S1IS Deny write to anonymous user”; deny (add,write,delete) roledn =”ldap:///cn=Deny Write Access,$rootSuffix”;)
操作:放弃。
此 ACI 属于拒绝写访问角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix)))) (targetattr != “nsroledn”) (version 3.0; acl “S1IS Container Admin Role access allow”; allow (all) roledn = “ldap:///cn=Container Admin Role,[$dn],$rootSuffix”;)
操作:放弃。
此 ACI 属于容器管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///cn=Container Admin Role,($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Container Admin Role access deny”; deny (write,add,delete,compare,proxy) roledn = “ldap:///cn=Container Admin Role,($dn),$rootSuffix”;)
操作:放弃。
此 ACI 属于容器管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///ou=People,$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix) (nsroledn=cn=Organization Admin Role,$rootSuffix) (nsroledn=cn=Container Admin Role,$rootSuffix)))) (targetattr != “iplanet-am-web-agent-access-allow-list || iplanet-am-domain-url-access-allow || iplanet-am-web-agent-access-deny-list || nsroledn”) (version 3.0; acl “S1IS Group and people container admin role”; allow (all) roledn = “ldap:///cn=ou=People_dc=red_dc=iplanet_dc=com,$rootSuffix”;)
操作:放弃。
此 ACI 属于组和人员容器管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (extra verses dreambig) (target=”ldap:///$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix) (nsroledn=cn=Organization Admin Role,$rootSuffix)))) (targetattr = “*”) (version 3.0; acl “S1IS Organization Help Desk Admin Role access allow”; allow (read,search) roledn = “ldap:///cn=Organization Help Desk Admin Role,$rootSuffix”;)
操作:放弃。
此 ACI 属于组织帮助台管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix) (nsroledn=cn=Organization Admin Role,$rootSuffix)))) (targetattr = “userPassword”) (version 3.0; acl “S1IS Organization Help Desk Admin Role access allow”; allow (write) roledn = “ldap:///cn=Organization Help Desk Admin Role,$rootSuffix”;)
操作:放弃。
此 ACI 属于组织帮助台管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (different name - “allow all” instead of “allow”) (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix)))) (targetattr != “nsroledn”) (version 3.0; acl “S1IS Organization Admin Role access allow all”; allow (all) roledn =”ldap:///cn=Organization Admin Role,[$dn],$rootSuffix”;)
操作:合并。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (target=”ldap:///cn=Organization Admin Role,($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Organization Admin Role access deny”; deny (write,add,delete,compare,proxy) roledn = “ldap:///cn=Organization Admin Role,($dn),$rootSuffix”;)
操作:合并。
此 ACI 属于组织管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (missing) (target=”ldap:///($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “Organization Admin Role access allow read to org node”; allow (read,search) roledn = “ldap:///cn=Organization Admin Role,($dn),$rootSuffix” ;)
操作:合并。
此 ACI 属于组织管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix)))) (targetattr != “nsroledn”) (version 3.0; acl “Organization Admin Role access allow”; allow (all) roledn = “ldap:///cn=Organization Admin Role,[$dn],$rootSuffix”;)
操作:合并。
此 ACI 属于组织管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (target=”ldap:///($dn),$rootSuffix”) (targetattr!=”businessCategory || description || facsimileTelephoneNumber || postalAddress || preferredLanguage || searchGuide || postOfficeBox || postalCode || registeredaddress || street || l || st || telephonenumber ||maildomainreportaddress || maildomainwelcomemessage || preferredlanguage || sunenablegab”) (version 3.0; acl “Organization Admin Role access deny to org node”; deny (write,add,delete) roledn = “ldap:///cn=Organization Admin Role,($dn),$rootSuffix” ;)
操作:合并。
此 ACI 属于组织管理角色。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix)))) (targetattr != “nsroledn”) (version 3.0; acl “S1IS Organization Admin Role access allow all”; allow (all) roledn = “ldap:///cn=Organization Admin Role,[$dn],$rootSuffix”;)
操作:合并。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # # discard # aci: (target=”ldap:///$rootSuffix”) (targetattr!=”nsroledn”) (version 3.0; acl “S1IS Group admin’s right to the users he creates”; allow (all) userattr = “iplanet-am-modifiable-by#ROLEDN”;)
操作:放弃。
放弃此 ACI 将会禁用与属性 iplanet-am-modifiable-by 关联的权限。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “Messaging Server End User Administrator Read Access Rights - product=SOMS,schema 2 support,class=installer,num=1,version=1”; allow (read,search) groupdn=”ldap:///cn=Messaging End User Administrators Group, ou=Groups, $rootSuffix”;)
操作:合并。
此 ACI 可向通讯最终用户管理员组授予权限。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (target=”ldap:///$rootSuffix”) (targetattr=”objectclass||mailalternateaddress||mailautoreplymode ||mailprogramdeliveryinfo||nswmextendeduserprefs||preferredlanguage ||maildeliveryoption||mailforwardingaddress ||mailAutoReplyTimeout||mailautoreplytextinternal||mailautoreplytext ||vacationEndDate||vacationStartDate||mailautoreplysubject||pabURI ||maxPabEntries||mailMessageStore||mailSieveRuleSource||sunUCDateFormat ||sunUCDateDeLimiter||sunUCTimeFormat”) (version 3.0; acl “Messaging Server End User Adminstrator Write Access Rights - product=SOMS,schema 2 support,class=installer,num=2,version=1”; allow (all) groupdn=”ldap:///cn=Messaging End User Administrators Group, ou=Groups, $rootSuffix”;)
操作:合并。
此 ACI 可向通讯最终用户管理员组授予权限。
-------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------
# # consolidate # aci: (targetattr=”uid||ou||owner||mail||mailAlternateAddress ||mailEquivalentAddress||memberOf ||inetuserstatus||mailuserstatus||memberOfManagedGroup||mailQuota ||mailMsgQuota||inetSubscriberAccountId||dataSource||mailhost ||mailAllowedServiceAcces||pabURI||inetCOS||mailSMTPSubmitChannel ||aci”) (targetfilter=(&(objectClass=inetMailUser)(!(nsroledn=cn=Organization Admin Role,*)))) (version 3.0; acl “Deny write access to users over Messaging Server protected attributes - product=SOMS,schema 2 support,class=installer,num=3,version=1 “; deny (write) userdn = “ldap:///self”;)
操作:合并。
这是若干用于设置自身权限的 ACI 之一。
-------------------------------------------------------------------------------------------------------------
本节中的列表显示了在替换 ldif 文件 replacement.acis.ldif(此文件可用于合并目录中的 ACI)中已被合并的 ACI。有关如何替换 ACI 的说明,请参见替换 ACI 的步骤。
ACI 分为若干对。对于每种类别,均先列出原始 ACI,再列出合并后的 ACI:
aci: (targetattr != “userPassword || passwordHistory || passwordExpirationTime || passwordExpWarned || passwordRetryCount || retryCountResetTime || accountUnlockTime || passwordAllowChangeTime “) (version 3.0; acl “Anonymous access”; allow (read, search, compare) userdn = “ldap:///anyone”;)
aci: (target=”ldap:///cn=Top-level Admin Role,$rootSuffix”) (targetattr=”*”) version 3.0; acl “S1IS Top-level admin delete right denied”; deny (delete) userdn = “ldap:///anyone”; ) aci: (target=”ldap:///$rootSuffix”) (targetfilter=(entrydn=$rootSuffix)) (targetattr=”*”) (version 3.0; acl “S1IS Default Organization delete right denied”; deny (delete) userdn = “ldap:///anyone”; ) aci: (target=”ldap:///ou=services,$rootSuffix”) (targetfilter=(!(objectclass=sunServiceComponent))) (targetattr = “*”) (version 3.0; acl “S1IS Services anonymous access”; allow (read, search, compare) userdn = “ldap:///anyone”;) aci: (target=”ldap:///ou=iPlanetAMAdminConsoleService,*,$rootSuffix”) (targetattr = “*”) (version 3.0; acl “S1IS iPlanetAMAdminConsoleService anonymous access”; allow (read, search, compare) userdn = “ldap:///anyone”;)
aci: (target=”ldap:///$rootSuffix”) (targetfilter=(!(objectclass=sunServiceComponent))) (targetattr != “userPassword||passwordHistory ||passwordExpirationTime||passwordExpWarned||passwordRetryCount ||retryCountResetTime||accountUnlockTime||passwordAllowChangeTime”) (version 3.0; acl “anonymous access rights”; allow (read,search,compare) userdn = “ldap:///anyone”; )
分析:此 ACI 位于根上,它可与原始匿名 ACI 集合授予相同的访问权限。它通过列出一组排除的属性来执行此操作。由于此替换 ACI 清除了目标中的 (*),因此可提高性能。
aci: (targetattr != “nsroledn || aci || nsLookThroughLimit || nsSizeLimit || nsTimeLimit || nsIdleTimeout || passwordPolicySubentry || passwordExpirationTime || passwordExpWarned || passwordRetryCount || retryCountResetTime || accountUnlockTime || passwordHistory || passwordAllowChangeTime”) (version 3.0; acl “Allow self entry modification except for nsroledn, aci, resource limit attributes, passwordPolicySubentry and password policy state attributes”; allow (write) userdn =”ldap:///self”;) aci: (targetattr = “*”) (version 3.0; acl “S1IS Deny deleting self”; deny (delete) userdn =”ldap:///self”;) aci: (targetattr = “objectclass || inetuserstatus || planet-am-web-agent-access-allow-list || iplanet-am-domain-url-access-allow || iplanet-am-web-agent-access-deny-list || iplanet-am-user-account-life || iplanet-am-session-max-session-time || iplanet-am-session-max-idle-time || iplanet-am-session-get-valid-sessions || iplanet-am-session-destroy-sessions || iplanet-am-session-add-session-listener-on-all-sessions || iplanet-am-user-admin-start-dn || iplanet-am-auth-post-login-process-class”) (targetfilter=(!(nsroledn=cn=Top-levelAdmin Role,$rootSuffix))) (version 3.0; acl “S1IS User status self modification denied”; deny (write) userdn =”ldap:///self”;) aci: (targetattr != “iplanet-am-static-group-dn || uid || nsroledn || aci || LookThroughLimit || nsSizeLimit || nsTimeLimit || nsIdleTimeout || memberOf || planet-am-web-agent-access-allow-list || iplanet-am-domain-url-access-allow || planet-am-web-agent-access-deny-list”) (version 3.0; acl “S1IS Allow self entry modification except for nsroledn, aci, and resource limit attributes”; allow (write) userdn =”ldap:///self”;) aci: (targetattr != “aci || nsLookThroughLimit || nsSizeLimit || nsTimeLimit || nsIdleTimeout || iplanet-am-domain-url-access-allow”) (version 3.0; acl “S1IS Allow self entry read search except for nsroledn, aci, resource limit and web agent policy attributes”; allow (read,search) userdn =”ldap:///self”;) aci: (targetattr=”uid||ou||owner||mail||mailAlternateAddress ||mailEquivalentaddress||memberOf ||inetuserstatus||mailuserstatus||memberOfManagedGroup||mailQuota ||mailMsgQuota ||inetSubscriberAccountId||dataSource||mailhost||mailAllowedServiceAccess ||pabURI||inetCOS||mailSMTPSubmitChannel||aci”) (targetfilter=(&(objectClass=inetMailUser)(!(nsroledn=cn=Organization Admin role,*)))) (version 3.0; acl “Deny write access to users over Messaging Server protected attributes - product=SOMS,schema 2 support,class=installer,num=3,version=1 “; deny (write) userdn = “ldap:///self”;)
aci: (targetattr != “nsroledn || aci || nsLookThroughLimit || nsSizeLimit || nsTimeLimit || nsIdleTimeout || passwordPolicySubentry || asswordExpirationTime || passwordExpWarned || passwordRetryCount || retryCountResetTime || accountUnlockTime || passwordHistory || passwordAllowChangeTime || id || memberOf || objectclass || inetuserstatus || ou || owner || mail || mailuserstatus || memberOfManagedGroup ||mailQuota || mailMsgQuota || mailhost || mailAllowedServiceAccess || inetCOS || mailSMTPSubmitChannel”) (version 3.0; acl “Allow self entry modification”; allow (write) userdn =”ldap:///self”;) aci: (targetattr != “ aci || nsLookThroughLimit || nsSizeLimit || nsTimeLimit|| nsIdleTimeout”) (version 3.0; acl “Allow self entry read search”; allow(read,search) userdn =”ldap:///self”;)
分析:不具有全部 iplanet-am-* 属性。由于在 ACI 不存在的情况下默认值为 deny,因此所有 deny ACI 都被删除。允许 write 的各个 ACI 将被合并为单个 ACI。
aci: (target=”ldap:///$rootSuffix”) (targetattr=”*”) (version 3.0; acl “Messaging Server End User Administrator Read Access Rights - product=SOMS,schema 2 support,class=installer,num=1,version=1”; allow (read,search) groupdn=”ldap:///cn=Messaging End User Administrators Group, ou=Groups, rootSuffix”;) aci: (target=”ldap:///$rootSuffix”) (targetattr=”objectclass||mailalternateaddress||mailautoreplymode|| mailprogramdeliveryinfo ||nswmextendeduserprefs||preferredlanguage||maildeliveryoption|| mailforwardingaddress ||mailAutoReplyTimeout||mailautoreplytextinternal||mailautoreplytext|| vacationEndDate ||vacationStartDate||mailautoreplysubject||pabURI||maxPabEntries|| mailMessageStore ||mailSieveRuleSource||sunUCDateFormat||sunUCDateDeLimiter|| sunUCTimeFormat”) (version 3.0; acl “Messaging Server End User Adminstrator Write Access Rights - product=SOMS,schema 2 support,class=installer,num=2,version=1”; allow (all) groupdn=”ldap:///cn=Messaging End User Administrators Group, ou=Groups, rootSuffix”;) aci: (targetattr=”uid||ou||owner||mail||mailAlternateAddress|| mailEquivalentAddress||memberOf ||inetuserstatus||mailuserstatus||memberOfManagedGroup||mailQuota|| mailMsgQuota ||inetSubscriberAccountId||dataSource||mailhost||mailAllowedServiceAccess ||pabURI||inetCOS||mailSMTPSubmitChannel||aci”) (targetfilter=(&(objectClass=inetMailUser)(!(nsroledn=cn=Organization Admin Role,*)))) (version 3.0; acl “Deny write access to users over Messaging Server protected attributes - product=SOMS,schema 2 support,class=installer,num=3,version=1 “; deny (write) userdn = “ldap:///self”;)
ACI 自身在多个 ACI 自身中处理。
aci: (targetattr=”*”) (version 3.0; acl “Messaging Server End User Administrator Read Only Access”; allow (read,search) groupdn = “ldap:///cn=Messaging End User Administrators group,ou=Groups,$rootSuffix”; ) aci: (targetattr=”objectclass || mailalternateaddress || Mailautoreplymode || mailprogramdeliveryinfo || preferredlanguage || maildeliveryoption || mailforwardingaddress || mailAutoReplyTimeout || mailautoreplytextinternal || mailautoreplytext || vacationEndDate || vacationStartDate || mailautoreplysubject || maxPabEntries || mailMessageStore || mailSieveRuleSource || sunUCDateFormat || sunUCDateDeLimiter || sunUCTimeFormat || mailuserstatus || maildomainstatus || nswmextendeduserprefs || pabURI”) (version 3.0; acl “Messaging Server End User Administrator All Access”; allow (all) groupdn = “ldap:///cn=Messaging End User Administrators group,ou=Groups,$rootSuffix”;)
分析:与原始 ACI 相同。
aci: (different name - “allow all” instead of “allow”) (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix)))) (targetattr != “nsroledn”) (version 3.0; acl “S1IS Organization Admin Role access allow all”; allow (all) roledn =”ldap:///cn=Organization Admin Role,[$dn],$rootSuffix”;) aci: (missing) (target=”ldap:///($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “Organization Admin Role access allow read to org node”; allow (read,search) roledn = “ldap:///cn=Organization Admin Role,($dn),$rootSuffix” ;) aci: (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix)))) (targetattr != “nsroledn”) (version 3.0; acl “Organization Admin Role access allow”; allow (all) roledn = “ldap:///cn=Organization Admin Role,[$dn],$rootSuffix”;) aci: (target=”ldap:///($dn),$rootSuffix”) (targetattr!=”businessCategory || description || facsimileTelephoneNumber || postalAddress || preferredLanguage || searchGuide || postOfficeBox || postalCode || registeredaddress || street || l || st || telephonenumber || maildomainreportaddress || maildomainwelcomemessage || preferredlanguage || sunenablegab”) (version 3.0; acl “Organization Admin Role access deny to org node”; deny (write,add,delete) roledn = “ldap:///cn=Organization Admin Role,($dn),$rootSuffix” ;) aci: (duplicate of per organization aci) (target=”ldap:///cn=Organization Admin Role,($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Organization Admin Role access deny”; deny (write,add,delete,compare,proxy) roledn = “ldap:///cn=Organization Admin Role,($dn),$rootSuffix”;) aci: (target=”ldap:///cn=Organization Admin Role,($dn),dc=red,dc=iplanet,dc=com”) (targetattr=”*”) (version 3.0; acl “S1IS Organization Admin Role access deny”; deny (write,add,delete,compare,proxy) roledn = “ldap:///cn=Organization Admin Role,($dn),$rootSuffix”;) aci: (target=”ldap:///o=fullOrg1,o=VIS,o=siroe.com,o=SharedDomainsRoot, o=Business,rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,dc=red,dc=iplanet,dc=com)))) (targetattr = “nsroledn”) (targattrfilters=”add=nsroledn:(nsroledn=*,o=fullOrg1,o=VIS,o=siroe.com, o=SharedDomainsRoot,o=Business,$rootSuffix), del=nsroledn:(nsroledn=*,o=fullOrg1,o=VIS,o=siroe.com,o=SharedDomainsRoot, o=Business,$rootSuffix)”) (version 3.0; acl “S1IS Organization Admin Role access allow”; allow (all) roledn = “ldap:///cn=Organization Admin Role,o=fullOrg1,o=VIS,o=siroe.com,o=SharedDomainsRoot,o=Business, $rootSuffix”;) aci: (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix)))) (targetattr != “nsroledn”) (version 3.0; acl “S1IS Organization Admin Role access allow all”; allow (all) roledn = “ldap:///cn=Organization Admin Role,[$dn],dc=red,dc=iplanet,dc=com”;)
aci: (target=”ldap:///cn=Organization Admin Role,($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Organization Admin Role access deny”; deny (write,add,delete,compare,proxy) roledn = “ldap:///cn=Organization Admin Role,($dn),$rootSuffix”;) aci: (target=”ldap:///($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “Organization Admin Role access allow read”; allow(read,search) roledn = “ldap:///cn=Organization Admin Role,[$dn],$rootSuffix” ;) aci: (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (entrydn=($dn),$rootSuffix)))) ( targetattr = “*”) (version 3.0; acl “S1IS Organization Admin Role access allow”; allow (all) roledn = “ldap:///cn=Organization Admin Role,[$dn],$rootSuffix”;)
本节中的列表显示了当您将 replacement.acis.ldif 文件应用于目录时将放弃的、目录中未使用的默认 ACI。
要放弃的 ACI 分为以下几种类别:
# discard # aci: (targetattr =”*”) (version 3.0;acl “Configuration Administrators Group”; allow (all) (groupdn = “ldap:///cn=Configuration Administrators, ou=Groups, ou=TopologyManagement, o=NetscapeRoot”);) # # discard # aci: (targetattr =”*”) (version 3.0;acl “Directory Administrators Group”; allow (all) (groupdn = “ldap:///cn=Directory Administrators, $rootSuffix”);) # # discard # aci: (targetattr = “*”) (version 3.0; acl “SIE Group”; allow (all) groupdn = “ldap:///cn=slapd-whater, cn=Sun ONE Directory Server, cn=Server Group, cn=whater.red.iplanet.com, ou=red.iplanet.com, o=NetscapeRoot”;) # # discard - prevents TLA from modifying the amldapuser account. # aci: (target=”ldap:///cn=amldapuser,ou=DSAME Users,$rootSuffix”) (targetattr = “*”) (version 3.0; acl “S1IS special ldap auth user modify right”; deny (write) roledn != “ldap:///cn=Top-level Admin Role,$rootSuffix”;) # # discard - protects SAML related attributes # aci: (targetattr=”iplanet-am-saml-user || iplanet-am-saml-password”) (targetfilter=”(objectclass=iplanet-am-saml-service)”) (version 3.0; acl “S1IS Right to modify saml user and password”; deny (all) (roledn != “ldap:///cn=Top-level Admin Role,$rootSuffix”) AND (userdn != “ldap:///cn=dsameuser,ou=DSAME Users,$rootSuffix”) AND (userdn != “ldap:///cn=puser,ou=DSAME Users,$rootSuffix”); )
# # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(!(nsroledn=cn=Top-level Admin Role,$rootSuffix))) (targetattr = “*”) (version 3.0; acl “S1IS Top-level Help Desk Admin Role access allow”; allow (read,search) roledn = “ldap:///cn=Top-level Help Desk Admin Role,$rootSuffix”;) # # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(!(nsroledn=cn=Top-level Admin Role,$rootSuffix))) (targetattr = “userPassword”) (version 3.0; acl “S1IS Top-level Help Desk Admin Role access allow”; allow (write) roledn = “ldap:///cn=Top-level Help Desk Admin Role,$rootSuffix”;)
# # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix)))) (targetattr = “*”) (version 3.0; acl “S1IS Top-level Policy Admin Role access allow”; allow (read,search) roledn = “ldap:///cn=Top-level Policy Admin Role,$rootSuffix”;) # # discard # aci: (target=”ldap:///ou=iPlanetAMAuthService,ou=services,*$rootSuffix”) (targetattr = “*”) (version 3.0; acl “S1IS Top-level Policy Admin Role access Auth Service deny”; deny (add,write,delete) roledn = “ldap:///cn=Top-level Policy Admin Role,$rootSuffix”;) # # discard # aci: (target=”ldap:///ou=services,*$rootSuffix”) (targetattr = “*”) (version 3.0; acl “S1IS Top-level Policy Admin Role access allow”; allow (all) roledn = “ldap:///cn=Top-level Policy Admin Role,$rootSuffix”;) # # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=”(objectclass=sunismanagedorganization)”) (targetattr = “sunRegisteredServiceName”) (version 3.0; acl “S1IS Top-level Policy Admin Role access allow”; allow (read,write,search) roledn = “ldap:///cn=Top-level Policy Admin Role,$rootSuffix”;)
# # discard - prevents anyone other than rootdn from deleting # default organization. # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(entrydn=$rootSuffix)) (targetattr=”*”) (version 3.0; acl “S1IS Default Organization delete right denied”; deny (delete) userdn = “ldap:///anyone”; ) # # discard - prevents any user other than rootdn from deleting the # TLA admin role. # aci: (target=”ldap:///cn=Top-level Admin Role,$rootSuffix”) (targetattr=”*”) version 3.0; acl “S1IS Top-level admin delete right denied”; deny(delete) userdn = “ldap:///anyone”; )
# # discard # aci: (targetattr = “*”) (version 3.0; acl “S1IS Deny write to anonymous user”; deny (add,write,delete) roledn =”ldap:///cn=Deny Write Access,$rootSuffix”;)
# # discard # aci: (target=”ldap:///($dn),$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix)))) (targetattr != “nsroledn”) (version 3.0; acl “S1IS Container Admin Role access allow”; allow (all) roledn = “ldap:///cn=Container Admin Role,[$dn],$rootSuffix”;) # # discard # aci: (target=”ldap:///cn=Container Admin Role,($dn),$rootSuffix”) (targetattr=”*”) (version 3.0; acl “S1IS Container Admin Role access deny”; deny (write,add,delete,compare,proxy) roledn = “ldap:///cn=Container Admin Role,($dn),$rootSuffix”;) # # discard # aci: (target=”ldap:///ou=People,$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix) (nsroledn=cn=Organization Admin Role,$rootSuffix) (nsroledn=cn=Container Admin Role,$rootSuffix)))) (targetattr != “iplanet-am-web-agent-access-allow-list || iplanet-am-domain-url-access-allow || iplanet-am-web-agent-access-deny-list || nsroledn”) (version 3.0; acl “S1IS Group and people container admin role”; allow (all) roledn = “ldap:///cn=ou=People_dc=red_dc=iplanet_dc=com,$rootSuffix”;)
# # discard # aci: (extra verses dreambig) (target=”ldap:///$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix) (nsroledn=cn=Organization Admin Role,$rootSuffix)))) (targetattr = “*”) (version 3.0; acl “S1IS Organization Help Desk Admin Role access allow”; allow (read,search) roledn = “ldap:///cn=Organization Help Desk Admin Role,$rootSuffix”;) # # discard # aci: (target=”ldap:///$rootSuffix”) (targetfilter=(!(|(nsroledn=cn=Top-level Admin Role,$rootSuffix) (nsroledn=cn=Top-level Help Desk Admin Role,$rootSuffix) (nsroledn=cn=Top-level Policy Admin Role,$rootSuffix) (nsroledn=cn=Organization Admin Role,$rootSuffix)))) (targetattr = “userPassword”) (version 3.0; acl “S1IS Organization Help Desk Admin Role access allow”; allow (write) roledn = “ldap:///cn=Organization Help Desk Admin Role,$rootSuffix”;)
# # discard - Removal disables the associated privileges to the attribute # iplanetam-modifiable-by # aci: (target=”ldap:///$rootSuffix”) (targetattr!=”nsroledn”) (version 3.0; acl “S1IS Group admin’s right to the users he creates”; allow (all) userattr = “iplanet-am-modifiable-by#ROLEDN”;)