Download LDAP System Administration

[ Team LiB ]
E.3 How Much?
OpenLDAP supports two modes of defining access. The general form of the access specifier clause is:
[self]{level|priv}
The special modifier self implies special access to self-owned attributes such as the member attribute in a group.
While the access level model implements incremental access (higher access includes lower access levels), the
privilege model requires that an administrator explicitly define access for each permission using the =,+, and operators to reset, add, and remove permissions, respectively (see Table E-3).
•
Table of Contents
•
Index
•
•
Reviews
Table
E-3. Reviews
Summary of access and privilege levels from most (top) to least (bottom)
Reader
•
Errata
Access
LDAP
System
Privilege
Administration
level
By Gerald Carter
write
Publisher
read
Pub Date
ISBN
search
Pages
compare
w
Permission granted
Access to update attribute values (e.g., change this telephoneNumber to 555-2345).
Access to read search results (e.g., Show me all the entries with a telephoneNumber of
: March 2003555*).
Access to apply search filters (e.g., Are there any entries with a telephoneNumber of
:s
1-56592-491-6
555*?).
: 308
:r
O'Reilly
c
Access to compare attributes (e.g., Is your telephoneNumber 555-1234?).
Access to bind (authenticate). This requires that the client send a username in the form of
a DN and some type of credentials to prove his or her identity.
If
you
want
to
be
a
master
of your domain, LDAP System Administration will help you get up and running quickly
none
No access.
regardless of which LDAP version you use. After reading this book, even with no previous LDAP experience, you'll
be
able flow
to integrate
a directory
server
into
essential
such as mail,
DNS,
HTTP, ,and
Control
from one
access rule
to the
next
can be network
managedservices
by the keywords
stop
,continue
andSMB/CIFS.
break (see
auth
x
Table E-4).
[ Team LiB ]
Table E-4. Control flow keywords in access rules
Keyword
break
Meaning
Allows other access clauses to be processed
continue Allows additional "who" clauses within the current access rule to be processed
stop
Stops access check upon a match (default)
[ Team LiB ]