SAS® Integration Technologies: Administrator's Guide (LDAP Version)

SAS® Integration Technologies: Administrator's Guide (LDAP Version)
AclEntry
The aclEntry attribute describes the access granted to the entry object. It describes who has rights (the subject), what
rights they have to the object itself, and what rights they have to the attributes of the object. The format of the aclEntry
attribute is:
:::
Subject−type
SubjectDn
Object−access
Attribute−access
one of access−id, group, or role. If access−id, then subjectDN should be the DN of a
user entry. If group, subjectDN should be the DN of an AccessGroup entry, and role
should point to an AccessRole entry.
The Dn of the subject for the aclEntry.
The access rights granted to the object itself. Valid permissions are a to allow the
subject to add children under the entry, and d to allow delete permission. The format for
object access is "object:permissions".
Specifies the permissions granted to the entry attributes. There are three levels of
attribute access: normal, sensitive, and critical. The security level for an attribute is
defined in the schema.
AclPropagate
This attribute will have a value of "true" or "false". The default is "true", and indicates that the aclEntry values for this
entry should propagate down the hierarchy to apply to any entries below it which don't have their own aclEntry
attribute(s).
EntryOwner
Like the subject clause of the aclEntry, the entryOwner has a subject type and a subjectDN. The subject type can be
access−id, group, or role. The subjectDN should be the distinguished name of an entity that represents the correct type
of entry (person, accessGroup, or accessRole).
Example: access−id:cn=SAS,o=SAS Institute,c=US
OwnerPropogate
A value of "true" or "false" that determines whether the entryOwner value will propogate to down the hierarchy to
apply to entries below it.
ACI Rule Considerations
AclEntry attributes in SecureWay propogate down (assuming aclPropogate is true) to all its subordinates until the
aclEntry is overridden. Any aclEntry will override all the values of the previous aclSource. That is to say, if you want
to add access by another individual or group at a given point in the tree, while retaining the access controls specified
higher up, you must copy the aclEntry attribute values that the entry is already inheriting, and add the new values. Just
creating an aclEntry with the new value will revoke the access provided by the previous aclSource.
SecureWay Directory Server Access Control Overview 239