Setting Up Access Control Lists (ACL)

Overview

An Access Control List (ACL) is an optional feature of LDAP Services for NDS that allows you to create an additional layer of security between LDAP clients and NDS. You can use ACLs to implement LDAP client access restrictions for all LDAP servers in an LDAP Group object.

An ACL accomplishes the following:

• Creates container object attribute-level access controls that are inherited by the objects the container contains.
• Controls access based on criteria that NDS does not use (such as IP addresses).
• Implements more restrictive rights to NDS when accessed via LDAP (such as Read-only or publishing just names and e-mail addresses).

Each ACL contains the following components:

• Access To List
• Access By List

To create an ACL, use NetWare Administrator (nwadmn32.exe) to configure the LDAP Group object Access Control page.

ACL Processing Order

The order of the ACLs in the list is important. When LDAP Services for NDS receives a client request, it searches the ACL list and uses the first ACL that specifies the requested attributes in the Access To List. LDAP Services for NDS then searches Access By List and uses the first entry that includes the LDAP client user. If no ACL is found, full NDS rights are given.

For example, suppose that you specified two ACLs, one for Organizational Unit Acme and one for User object Jim within Acme. Now suppose that the ACLs appear in the following order:

o=Acme, c=us

cn=Jim, o=Acme, c=us

In this example, the ACL for Jim would never be processed because Jim is part of the Acme organization. Every request for Jim would be processed by the ACL for Acme because Jim is part of Acme. To provide separate controls for user object Jim, you need to move this object above Organizational Unit object Acme in the ACL list.

Now consider an example of the processing order used in the Access By List. Suppose that the Access By List contains two entries, one for Jeff and one for his group, TeamT. Jeff is a member of TeamT and the entries appear in the following order with the indicated access level:

.*,ou=TeamT, o=Acme, c=us (Read access)

Jeff, ou=TeamT, o=Acme, c=us (Write access)

In this example, Jeff has Read access to the objects in the Access To List because he is recognized as part of the TeamT group. To give Jeff the intended level of access, you need to move the entry for Jeff above the entry for TeamT in the Access By List.

To change the ACL processing order, use NetWare Administrator (nwadmn32.exe) to configure the LDAP Group object Access Control page.