Using Roles
Chapter 5
Advanced Entry Management
171
• Using Roles Securely
About Roles
Roles unify the static and dynamic group concept supported by previous versions
of Directory Server.
You can use roles to:
• Enumerate the members of a role.
Having an enumerated list of role members can be useful for resolving queries
for role members quickly.
• Determine whether a given entry possesses a particular role.
Knowing the roles possessed by an entry can help you determine whether the
entry possesses the target role.
• Enumerate all the roles possessed by a given entry.
• Assign a particular role to a given entry.
• Remove a particular role from a given entry.
With managed roles, you can do everything you would normally do with static
groups, and you can filter members using filtered roles as you used to do with
dynamic groups. Roles are easier to use than groups, more flexible in their
implementation, and reduce client complexity.
However, evaluating roles is more resource-intensive because the server does the
work for the client application. With roles, the client application can check role
membership by searching the
nsRole
attribute. The
nsRole
attribute is a computed
attribute, which identifies to which roles an entry belongs; the
nsRole
attribute is
not stored with the entry itself. From the client application point of view, the
method for checking membership is uniform and is performed on the server side.
Each role has
members
, or entries that possess the role. You can specify members
either explicitly or dynamically. How you specify role membership depends upon
the type of role you are using. Directory Server supports three types of roles:
NOTE
Use the
nsRole
attribute, not the
nsRoleDN
attribute, to evaluate role
membership.
Summary of Contents for DIRECTORY SERVER 7.1
Page 1: ...Administrator s Guide Red Hat Directory Server Version7 1 May 2005 Updated February 2009 ...
Page 20: ...20 Red Hat Directory Server Administrator s Guide May 2005 Glossary 619 Index 635 ...
Page 22: ...22 Red Hat Directory Server Administrator s Guide May 2005 ...
Page 26: ...26 Red Hat Directory Server Administrator s Guide May 2005 ...
Page 78: ...Maintaining Referential Integrity 78 Red Hat Directory Server Administrator s Guide May 2005 ...
Page 200: ...Assigning Class of Service 200 Red Hat Directory Server Administrator s Guide May 2005 ...
Page 488: ...488 Red Hat Directory Server Administrator s Guide May 2005 ...
Page 528: ...PTA Plug in Syntax Examples 528 Red Hat Directory Server Administrator s Guide May 2005 ...
Page 572: ...572 Red Hat Directory Server Administrator s Guide May 2005 ...
Page 612: ...Examples of LDAP URLs 612 Red Hat Directory Server Administrator s Guide May 2005 ...
Page 634: ...634 Red Hat Directory Server Administrator s Guide May 2005 ...
