Overview#

EDirectory Privileges

The privilege value depends on the setting for the protectedAttrName:

• [Entry Rights] permissions, the following bits are important:
  • 1-Browse - lets the trustee see the Subjectname in the tree. This does not include the right to see protectedAttrName values.
  • 2-Create - applies only when the target object is a container. Allows the trustee to create new objects below the container and also includes the Browse privilege.
  • 4-Delete - lets the trustee delete the target from the directory.
  • 8-Rename - lets the trustee change the name of the target
  • 16-Supervisor - includes all rights to the object and all of its properties.
  • 64-Inheritance Control - allow the Subjectname to control whether [Entry Rights] granted in an ACL (eDirectory Attribute) are inherited. If inherited, the Subjectname can exercise the rights granted in the ACL on subordinate objects. NetWare 5.x allows you to either allow inheritance or block inheritance. (NetWare 5.x utilities and their documentation call this right Inheritable.)
• [All Attribute Rights] permissions, the following bits are important:
  • 1-Compare - lets the trustee compare the value of a property to a given value. This right allows searching and returns only a true or false result. It does not allow the trustee to actually see the value of the property.
  • 2-Read - lets the trustee see the values of a property. It includes the Compare right
  • 4-Write - lets the trustee create, change, and delete the values of a property.
  • 8-Add Self - lets the trustee add or remove itself as a property value. Only applies to properties with object names as values, such as membership lists or Access Control Lists (ACLs).
  • 32-Supervisor - gives the trustee complete power over the property.
  • 64-Inheritance Control - controls whether the Subjectname inherits the other rights granted to a specific attribute or to [All Attributes Rights]. The bit can be set to allow or to block inheritance on both [All Attributes Rights] and specific attributes. Also enables the creation of managers who have rights to manage specific attributes, such as phone numbers, addresses, and passwords, without granting Supervisor rights to the objects. If the right is granted at the container level, the right can be inheritable to an entire branch of the eDirectory tree.

Category#

%category eDirectory%

More Information#

There might be more information for this subject on one of the following:

• Object ACL