Assigning NDS Rights for LDAP Clients

To assign NDS rights for LDAP clients:

Determine which type of username the LDAP clients will use to access NDS:

[Public] (anonymous bind)

Proxy user (proxy user anonymous bind)

NDS user (NDS user bind)

If users will use one Proxy user or multiple NDS usernames to access LDAP, create these usernames in NDS.

Assign the appropriate NDS rights to the usernames that LDAP clients will use.

The default rights that most users receive provide limited rights to the user's own object. To provide access to other objects and their attributes, you must change the rights assigned in NDS.

If the NDS rights assignment options do not provide the exact access level you want, you can implement additional controls using the optional LDAP Access Control List (ACL) feature.

When an LDAP client requests access to an NDS object and attribute, NDS accepts or rejects the request based on the LDAP client's NDS identity. The identity is set at bind time. Use the following tables to determine the NDS rights the LDAP client needs to complete the various types of LDAP client requests.

LDAP Object Access Requested	NDS Object Rights Required
Search	Browse
Add	Create
Delete	Delete
LDAP Attribute Access Requested	NDS Attribute Rights Required
Compare	Compare
Search	Compare
Read	Read
Write	Write

NOTE: NDS does not allow objects to inherit individual attribute rights from containers. One way to assign inheritable individual attribute rights is to use the LDAP Access Control List feature.

Also, those operations that require NDS Supervisor rights are currently not available through LDAP.