Understanding Novell eDirectory
61
no
vd
ocx
(e
n)
6 Ap
ril 20
07
Property Rights
When you make a trustee assignment, you can grant object rights and property rights. Object rights
apply to manipulation of the entire object, while property rights apply only to certain object
properties.
iManager gives you two options for managing property rights:
You can manage all properties at once when the [All Attributes Rights] item is selected.
You can manage one or more individual properties when the specific property is selected.
A description of each property right follows:
Supervisor
gives the trustee complete power over the property.
Compare
lets the trustee compare the value of a property to a given value. This right allows
searching and returns only a true or false result. It does not allow the trustee to actually see the
value of the property.
Read
lets the trustee see the values of a property. It includes the Compare right.
Write
lets the trustee create, change, and delete the values of a property.
Add Self
lets the trustee add or remove itself as a property value. It only applies to properties
with object names as values, such as membership lists or Access Control Lists (ACLs).
Effective Rights
Users can receive rights in a number of ways, such as explicit trustee assignments, inheritance, and
security equivalence. Rights can also be limited by Inherited Rights Filters and changed or revoked
by lower trustee assignments. The net result of all these actions—the rights a user can employ—are
called
effective rights
.
A user’s effective rights to an object are calculated each time the user attempts an action.
How Effective Rights Are Calculated
Each time a user attempts to access a network resource, eDirectory calculates the user’s effective
rights to the target resource using the following process:
1. eDirectory lists the trustees whose rights are to be considered in the calculation. These include
The user who is attempting to access the target resource.
The objects that the user is security equivalent to.
2. For each trustee in the list, eDirectory determines its effective rights as follows:
a. eDirectory starts with the inheritable rights that the trustee has at the top of the tree.
eDirectory checks the Object Trustees (ACL) property of the Tree object for entries that
list the trustee. If any are found and they are inheritable, eDirectory uses the rights
specified in those entries as the initial set of effective rights for the trustee.
b. eDirectory moves down a level in the branch of the tree that contains the target resource.
c. eDirectory removes any rights that are filtered at this level.
eDirectory checks the ACL at this level for Inherited Rights Filters (IRFs) that match with
the right types (object, all properties, or a specific property) of the trustee’s effective
Summary of Contents for EDIRECTORY 8.8 SP2
Page 4: ...novdocx en 6 April 2007...
Page 116: ...116 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 128: ...128 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 255: ...256 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 406: ...408 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 563: ...566 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 573: ...576 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 601: ...604 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
