64
Novell eDirectory 8.8 Administration Guide
no
vd
ocx
(e
n)
6 Ap
ril 20
07
There are three types of security equivalence:
Explicit: By assignment
Automatic: By membership in a group or role
Implied: Equivalent to all parent containers and the [Public] trustee
Security equivalence is effective only for one step. For example, if you make a third user security
equivalent to Joe in the example above, that user does not receive Admin rights.
Security equivalence is recorded in eDirectory as values in the User object’s Security Equal To
property.
When you add a User object as an occupant to an Organizational Role object, that User
automatically becomes security equivalent to the Organizational Role object. The same is true when
a User becomes a member of a Group role object.
Access Control List (ACL)
The Access Control List (ACL) is also called the Object Trustees property. Whenever you make a
trustee assignment, the trustee is added as a value to the Object Trustees (ACL) property of the
target.
This property has strong implications for network security for the following reasons:
Anyone who has the Supervisor or Write right to the Object Trustees (ACL) property of an
object can determine who is a trustee of that object.
Any users with the Add Self right to the Object Trustees (ACL) property of an object can
change their own rights to that object. For example, they can grant themselves the Supervisor
right.
For these reasons, be careful giving Add Self rights to all properties of a container object. That
assignment makes it possible for the trustee to become Supervisor of that container, all objects in it,
and all objects in containers beneath it.
Inherited Rights Filter (IRF)
The Inherited Rights Filter allows you to block rights from flowing down the eDirectory Tree. For
more information on configuring this filter, see
“Blocking Inherited Rights to an eDirectory Object
or Property” on page 69
.
1.10.3 Default Rights for a New Server
When you install a new Server object into a tree, the following trustee assignments are made:
Default Trustees
Default Rights
Admin (first eDirectory server in the tree)
Supervisor object right to the Tree object.
Admin has the Supervisor object right to the NetWare
Server object, which means that Admin also has the
Supervisor right to the root directory of the file system
of any volumes on the server.
[Public] (first eDirectory server in the tree)
Browse object right to the Tree object.
Summary of Contents for EDIRECTORY 8.8 SP2
Page 4: ...novdocx en 6 April 2007...
Page 116: ...116 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 128: ...128 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 255: ...256 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 406: ...408 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 563: ...566 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 573: ...576 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
Page 601: ...604 Novell eDirectory 8 8 Administration Guide novdocx en 6 April 2007...
