HP-UX Directory Server 8.1 deployment guide

8.7.1.3 Bind rules
The bind rule usually indicates the bind DN subject to the permission. It can also specify bind
attributes such as time of day or IP address.
Bind rules easily express that the ACI applies only to a user's own entry. This allows users to
update their own entries without running the risk of a user updating another user's entry.
Bind rules indicate that the ACI is applicable in specific situations:
• Only if the bind operation is arriving from a specific IP address or DNS host name. This is
often used to force all directory updates to occur from a given machine or network domain.
• If the person binds anonymously. Setting a permission for anonymous bind also means that
the permission applies to anyone who binds to the directory as well.
• For anyone who successfully binds to the directory. This allows general access while
preventing anonymous access.
• Only if the client has bound as the immediate parent of the entry.
• Only if the entry as which the person has bound meets a specific LDAP search criteria.
The Directory Server provides several keywords to more easily express these kinds of access:
• Parent
If the bind DN is the immediate parent entry, then the bind rule is true. This means that
specific permissions can be granted that allow a directory branch point to manage its
immediate child entries.
• Self
If the bind DN is the same as the entry requesting access, then the bind rule is true. Specific
permission can be granted to allow individuals to update their own entries.
• All
The bind rule is true for anyone who has successfully bound to the directory.
• Anyone
The bind rule is true for everyone. This keyword is used to allow or deny anonymous access.
8.7.2 Setting permissions
By default, all users are denied access rights of any kind, with the exception of the Directory
Manager. Consequently, some ACIs must be set for the directory for users to be able to access
the directory.
For information about how to set ACIs in the directory, refer to the HP-UX Directory Server
administrator guide.
8.7.2.1 The precedence rule
When a user attempts any kind of access to a directory entry, Directory Server examines the
access control set in the directory. To determine access, Directory Server applies the precedence
rule. This rule states that when two conflicting permissions exist, the permission that denies
access always takes precedence over the permission that grants access.
For example, if write permission is denied at the directory's root level, and that permission is
applied to everyone accessing the directory, then no user can write to the directory regardless
of any other permissions that may allow write access. To allow a specific user write permissions
to the directory, the scope of the original deny-for-write has to be set so that it does not include
that user. Then, there must be additional allow-for-write permission for the user in question.
8.7.2.2 Allowing or denying access
Access to the directory tree can be explicitly allowed or denied, but be careful of explicitly denying
access to the directory. Because of the precedence rule, if the directory finds rules explicitly
8.7 Designing access control 119