Through the use of administrative privileges and Access Control Information (ACIs) you can delegate specific server management tasks to selected individuals as you deem appropriate.
Access to Network Resources
Access to Server Tasks
All network resources registered in the same configuration directory form a Netscape topology. The entire navigation tree in Netscape Console represents a Netscape topology. An administration domain is a collection of host systems and servers that share the same user directory. A server group consists of all servers managed by the same Administration Server. Servers are the products that provide specific services such as directory, messaging, and publishing.
Table 6.1 Summary of Administrative Privileges
Figure 6.1 A member of the Administrator's group has an unrestricted view of network resources and server tasks.
Figure 6.2 A member of the Messaging Administrators group sees only the servers and tasks assigned to him.
The Configuration Administrators group is automatically created when the configuration directory is installed. Only members of the Configuration Administrators group the only person who can add more users to the group. Members of the Configuration Administrators group have unrestricted access permissions.
In the Change Directory window, indicate the location of the user directory that contains the Configuration Administrators group, then click OK.
User Directory Host. Enter the fully qualified host name where the user directory is installed. User Directory Port. Enter the port number you want to use to connect to the user directory. User Directory Subtree. Enter o=NetscapeRoot to indicate where to find the Configuration Administrators group. Bind DN. Enter the user ID or DN of a user authorized to change entries in the user directory. Bind Password. Enter the password of the user directory Administrator. Use the Search function to locate and highlight the Configuration Administrators group, then click Edit.
In the Edit Group window, click Members.
Click Add.
In the Search Users and Groups window, locate the user you want to add, then click OK.
Repeat this step until all the users you want to add to the group are displayed in the Add Group Members list, then click OK.
Users who have access permissions to a particular server can provide the same access to additional users. By default, the Configuration Administrator has the appropriate access permissions; Domain-level adminstrators and server administrations who've been given access permissions for an individual server can also provide the same access to other users.
From the Object menu, choose Set Access Permissions, and a list appears. The list contains the names users and groups who currently have access permissions for the selected object.
By default, the Configuration Administrators group has unrestricted access to all servers, even though its name does not display on this list. To deny access permission to a user or group in the list, select the user or group name, then click Delete User. Skip the rest of this procedure.
By default, the Configuration Administrators group has unrestricted access to all servers, even though its name does not display on this list.
To allow access permission to additional users or groups, click Add User. Use the Search dialog box as usual to locate the user or group you want to allow or deny access permissions to, then click OK.
To allow access permission to additional users or groups, click Add User.
In the Set Access Permissions dialog box, be sure that the user or group is added to the list, then click OK.
Each entry in the user directory maintained by a Directory Server can include one or more ACI attributes. Attributes contain access control information for the entry. The access control information is composed of three parts: a target, permissions, and bind rules.
The target specifies the object, object attributes, or group of objects and attributes you're controlling access to.
The permission specifically outlines what rights you are either allowing or denying. Read, write, and execute are typical access permissions specified in ACIs. See Table 6.1 on page 89 for a brief summary of access permissions.
The bind rules specify the circumstances under which access is to be allowed or denied. Bind rules may include any of the following:
dn: o=airius.com
objectClass: top
objectClass: organization
ACI: (target="ldap:///o=airius.com")(targetattr=*)
(version 3.0; acl "acl 1"; allow (all)
groupdn = "ldap:///cn=Directory Administrators, o=airius.com";)
(version 3.0; acl "acl 2"; deny (all)
groupdn != "ldap:///cn=Directory Administrators, o=airius.com"
and dayofweek = "Sun, Tues, Fri" and
(timeofday >= "0100" and timeofday <= "0300:);)
Setting Access Permissions for a Server Task
To set access permission for a server task:
From the server Tasks, select the task you want to allow or deny access permission to.
From the Edit menu, choose Set Access Permissions. The ACI Editor appears.
To create a new rule, click Add Rule. A default rule is added to the table.
To edit a rule in the table, single-click a cell to edit its contents, or double-click the cell to display a dialog box for entering additional information. Cells and related options are summarized in Table 6.2.
Continue using the Access Control Editor to create rules and enter settings as necessary, then click Save Changes. Click OK.
Continue using the Access Control Editor to create rules and enter settings as necessary, then click Save Changes.
Restart the server.
Table 6.2 The ACI Editor Settings and Options
Table 6.3 Access Permission for the Administration Server
"What's in an ACI"