SAS® Integration Technologies: Administrator's Guide (LDAP Version)

Sascomponent=sasPortal
The SAS Information Delivery Portal Installation Guide contains guidelines for setting the access controls on portal
entries.
Sascomponent=sasDataSources
This is another location that requires careful consideration. Libraries, tables, infomarts and other data sources may all
have individual security requirements. The most important thing to remember is to not place access controls at the
container level unless you want that access to apply to all of the entries below it.
Other locations
Other areas can be opened for read by any bound user, but you must make sure you do not put the ACI rule too far up
in the tree. For instance, the container cn=sasservers,sascomponent=sasServer can be opened for read by all, but
granting that access at sascomponent=sasServer gives access to logins.
Deny ACI Rules
Using deny ACI rules is a useful tool in certain situations, but it can be dangerous. If you want to limit access to a
segment of the tree, when higher−level ACI rules have allowed access, you can use deny to accomplish that.
Remember, though, that a deny cannot be undone. In other words, if you deny access at a directory entry to all users
who are not in a specified group, you cannot then allow a user who is not in that group to access the directory at a
lower level in the tree.
You must also remember that an explicit deny is not the same as an implicit allow. If you deny everyone except one
group, it does not necessarily mean that everyone in that group is allowed. If no explicit allow was ever specified, the
users in that group still do not have access. Deny ACI rules are usually most useful when used with a != operator on
the subject, for example:
ACI: (target="ldap:///sasUniqueName=Security Group A −
A000000E.WHSECGRP.A00001X7,cn=sasContentObjects,
sasmetadatacn=A0000001.WHDW.A000000E,cn=sasMetadata
Repositories,sascomponent=sasMetadataRepository,
cn=sas,o=sas institute,c=us") (targetattr="*")
(version 3.0; acl "Security Policy"; deny (all)
groupdn != "ldap:///cn=Distributed Technologies,
ou=groups,o=SAS Institute,c=US||ldap:///cn=IDBGroup,
ou=groups,o=SAS Institute,c=US" ;)
This rule denies access to everything below this entry to everyone that is not a member of the IDBGroup group. The
rule to remember is this: do not use deny unless there is no other way to accomplish what you need to do.
Security
SAS® Integration Technologies: Administrator's Guide (LDAP Version)
Sun ONE and Netscape Directory Server Access ControlOverview 232