This page (revision-3) was last changed on 29-Nov-2024 16:16 by -jim

This page was created on 29-Nov-2024 16:16 by unknown

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note
3 29-Nov-2024 16:16 10 KB -jim to previous
2 29-Nov-2024 16:16 10 KB -jim to previous | to last
1 29-Nov-2024 16:16 8 KB unknown to last

Page References

Incoming links Outgoing links
Object ACL
Object ACL

Version management

Difference between version and

At line 12 changed one line
* The [privileges] ([EDirectory Privileges])
* The [privileges] (privileges)
At line 63 added 16 lines
! [eDirectory Privileges] Field
The privilege value depends on the setting for the protectedAttrName:
* __[[Entry Rights]__ permissions, the following bits are important:
** 1-Browse - lets the [trustee] see the Subjectname in the tree. This does __not__ include the right to see protectedAttrName values.
** 2-Create - applies only when the target object is a container. Allows the [trustee] to create new objects below the container and also __includes the Browse__ privilege.
** 4-Delete - lets the [trustee] delete the target from the directory.
** 8-Rename - lets the [trustee] change the name of the target
** 16-Supervisor - includes all rights to the object and all of its properties.
** 64-Inheritance Control - allow the Subjectname to control whether [[Entry Rights] granted in an [ACL (eDirectory Attribute)] are inherited. If inherited, the Subjectname can exercise the rights granted in the ACL on subordinate objects. NetWare 5.x allows you to either allow inheritance or block inheritance. (NetWare 5.x utilities and their documentation call this right Inheritable.)
* __[[All Attribute Rights]__ permissions, the following bits are important:
** 1-Compare - lets the [trustee] compare the value of a property to a given value. This right allows searching and returns only a true or false result. It does __not__ allow the trustee to actually see the value of the property.
** 2-Read - lets the [trustee] see the values of a property. It __includes the Compare__ right
** 4-Write - lets the [trustee] create, change, and delete the values of a property.
** 8-Add Self - lets the [trustee] add or remove itself as a property value. __Only__ applies to properties with object names as values, such as membership lists or Access Control Lists (ACLs).
** 32-Supervisor - gives the [trustee] complete power over the property.
** 64-Inheritance Control - controls whether the Subjectname inherits the other rights granted to a specific attribute or to [[All Attributes Rights]. The bit can be set to __allow or to block__ inheritance on both [[All Attributes Rights] and specific attributes. Also enables the creation of managers who have rights to manage specific attributes, such as phone numbers, addresses, and passwords, without granting Supervisor rights to the objects. If the right is granted at the container level, the right can be inheritable to an entire branch of the eDirectory tree.
At line 64 changed 66 lines
The number before the first # is in decimal. Convert the decimal value to hexadecimal (base 16) and select the privileges from the following table (starting with the largest value, or at the bottom):
!! [eDirectory Privileges] Field
! Entry level Permissions
%%zebra-table
%%sortable
%%table-filter
||Decimal||Hexadecimal||Description
|1|1|entry_browse - lets the [trustee] see the Subjectname in the tree. This does __not__ include the right to see protectedAttrName values.
|2|2|entry_add - applies only when the target object is a container. Allows the [trustee] to create new objects below the container and also __includes the Browse__ privilege.
|4|4|entry_delete - lets the [trustee] [Delete] the target from the directory.
|8|8|entry_rename - lets the [trustee] change the name of the target
|16|10|entry_supervisor - includes all rights to the object and all of its properties.
|64|40|entry_inherit_ctl - allow the Subjectname to control whether [[Entry Rights] granted in an [ACL (eDirectory Attribute)] are inherited. If inherited, the Subjectname can exercise the rights granted in the ACL on subordinate objects. [NetWare] 5.x allows you to either allow inheritance or block inheritance.
/%
/%
/%
! Attribute level Permissions
%%zebra-table
%%sortable
%%table-filter
||Decimal||Hexadecimal||Description
|1|1|attr_compare - lets the [trustee] compare the value of a property to a given value. This right allows searching and returns only a true or false result. It does __not__ allow the trustee to actually see the value of the property.
|2|2|attr_read - lets the [trustee] see the values of a property. It __includes the Compare__ right
|4|4|attr_write - lets the [trustee] create, change, and delete the values of a property.
|8|8|attr_self - lets the [trustee] add or remove itself as a property value. __Only__ applies to properties with object names as values, such as membership lists or Access Control Lists (ACLs).
|32|20|attr_supervisor - gives the [trustee] complete power over the property.
|64|40|attr_inherit_ctl - controls whether the Subjectname inherits the other rights granted to a specific attribute or to [[All Attributes Rights]. The bit can be set to __allow or to block__ inheritance on both [[All Attributes Rights] and specific attributes. Also enables the creation of managers who have rights to manage specific attributes, such as phone numbers, addresses, and passwords, without granting Supervisor rights to the objects. If the right is granted at the container level, the right can be inheritable to an entire branch of the eDirectory tree.
/%
/%
/%
! Privilege for both Entries and Attrs
%%zebra-table
%%sortable
%%table-filter
||Decimal||Hexadecimal||Description
|536870912|20000000|Dynamic Groups
|1073741824|40000000|iManager Role Based Svcs
/%
/%
/%
Privilege for both Entries and [Attributes] [example]
So in the case of:
{{{ACL: 1073741863#subtree#cn=MyOrg,cn=User Management,cn=Role Based Service,ou=ENT,o=MyOrg#cn}}}
The ACL value is 1073741863 (decimal) which converts to 40000027 hex (or 0x40000027).
Starting at the bottom of the above table, this translates to:
* 0x40000000 = iManager Role Base Services granted privilege.
* 0x00000020 = Supervisor Permission to the attribute indicated (attr_supervisor)
* 0x00000004 = Write Permission to the attribute indicated (attr_write)
* 0x00000002 = Read Permission to the attribute indicated (attr_read)
* 0x00000001 = Compare Permission to the attribute indicated (attr_compare)
!! Scope Field
! Scope Field
At line 144 changed one line
!! protectedAttrName field
! protectedAttrName field
At line 150 changed one line
!! API Data Structures
! API Data Structures
At line 186 removed 2 lines
* [#3] - [!!! What does the numeric value of ACL mean in an LDAP export?
|https://support.microfocus.com/kb/doc.php?id=7006280|target='_blank'] - based on information obtained 2021-05-13
This page (revision-3) was last changed on 29-Nov-2024 16:16 by -jimTop