SAS® Integration Technologies: Administrator's Guide (LDAP Version)

Sun ONE and Netscape Directory Server Access Control
Overview
When LDAP was first developed, it was only a protocol for accessing data in an X500 directory server. Therefore,
many specifics of how the server itself was supposed to work were left out. Even when the new standard was written
for LDAP version 3 (RFC2251), some important issues were left out simply because the people involved had already
picked an implementation, and didn't want a new standard to force them to redesign and reimplement large portions of
their servers. Access control was one of those important issues. That is why when discussing access control, it is
important to remember that each vendor has a different mechanism, and very little is portable from one server to
another.
Access control starts with authentication. There are several mechanisms to accomplish the authentication, but all must
eventually resolve to a distinguished name (DN) that exists in the directory. This distinguished name is then used to
determine the access that is granted to a user. The process of associating a distinguished name with a user is called
binding. A user can bind to a server using the DN and a password, or they can bind anonymously, providing no
credentials.
Authentication is accomplished using access control information (ACI) rules. An ACI rule specifies the LDAP object
to which the rule applies, whether the rule allows the specified permission or denies it, the users who are permitted or
denied access, and what type of permission is being allowed or denied. For information on using the Integration
Technologies Administrator to specify ACI rules, see Setting Access Permissions for an Object and Specifying Bind
Rules.
The Sun ONE and Netscape mechanism for administering access controls is flexible and powerful, but can also be
complex. Some basics may make things clearer.
• By default, no access is allowed to the directory except to the directory manager. The directory manager
bypasses all access control checks, and is used to administer the directory. A new directory with no access
control information is unreadable by any user except the directory manager. This type of control is different
from an explicit deny, which will be discussed later in this document.
• All access control information propagates down from its target to all the children under that target.
• All access control is cumulative.
• You cannot limit the scope of access control information.
• If conflicting access control information exists, deny always overrides allow. In other words, if there are
access control lists that allow a user access, and another access control instruction that denies access, the deny
will always be preferred.
Sun ONE and Netscape Syntax
(target="ldap:///dn")(targetattr="attrname")
[(targetfilter="rfc2254−style filter")]
( version 3.0; acl "name"; (allow | deny)
(read, write, search, compare, selfwrite, add, delete )
(userdn | groupdn)="ldap:///dn";)
Details about each element in the syntax are as follows:
Sun ONE and Netscape Directory Server Access Control Overview 228