Changes between Version 4 and Version 5 of ALL__accounts_roles


Ignore:
Timestamp:
11/13/14 15:15:34 (10 years ago)
Author:
lttoth@…
Comment:

Final Formatted Version of document

Legend:

Unmodified
Added
Removed
Modified

  • ALL__accounts_roles

    v4 v5  
    9595== UNIX GROUPS AND MEMBER ACCOUNTS == 
    9696       === Directory Server Groups === 
     97       Accounts associated with these groups are italicized. 
     98 
    9799        ==== group: iplanet     ==== 
    98                 default group of iplanet account 
     100                Default group of //iplanet// account 
    99101 
    100102        ==== group: ldapgw ====  
    101                 default group of ldapgw account 
     103                Default group of //ldapgw// account 
    102104 
    103105        ==== group: updategw ==== 
    104                 group used by iplanet to expose files that must be visible to 'nobody'  
    105                 (future) group used by sxldap to expose files that must be visible to 'nobody' 
    106                 (owner of Apache processes) when executing update process CGI scripts 
    107  
     106                * Group used by //iplanet// to expose files that must be visible to //'nobody'// 
     107                * Group used by //sxldap// to expose files that must be visible to //'nobody'// 
     108                * Owner of Apache processes when executing update process CGI scripts 
    108109 
    109110        ==== group: edirgw ==== 
    110                 group used by ldapgw to expose files that must be visible to 'nobody'  
    111                 (owner of Apache processes) when executing gateway CGI scripts 
     111                * Group used by //ldapgw// to expose files that must be visible to //'nobody'//  
     112                * Owner of Apache processes when executing gateway CGI scripts 
    112113 
    113114=== Directory Server Accounts  === 
    … …  
    141142                        * <<directory servers>> iplanet 
    142143         
    143         ==== account: //iplanet// ====   
    144         UNIX account owning iPlanet directory and web update processes.   
     144        ==== account: //iplanet// ==== 
     145UNIX account owning iPlanet directory and web update processes.    
    145146                * Directory Locations 
    146                         ~iplanet/EDIR[TEST|PREP|PROD]/ 
    147                         ~iplanet/AUTH[TEST|PREP|PROD]/ 
     147                        * ~iplanet/EDIR[TEST|PREP|PROD]/ 
     148                        * ~iplanet/AUTH[TEST|PREP|PROD]/ 
    148149                * All directory maintenance related source code is stored under this account  
    149                         ~iplanet/local/ldap/ 
     150                        * ~iplanet/local/ldap/ 
    150151                * .shosts file must allow access by 
    151                         <<registry servers>>    sxldap 
     152                        * <<registry servers>>  sxldap 
    152153                * Group membership 
    153154                  * iplanet - primary group 
    154155                  * other   
    155156                  * edirgw  
    156                    * associated with files visible to all parties supporting gateways 
     157                    * associated with files visible to all parties supporting gateways 
    157158                  * updategw  
    158                    * associated with password files read by CGI scripts  
    159                    * any files opened during execution of CGI scripts  
    160                    * <GW>/ldap/web/log directory where output is written 
     159                    * associated with password files read by CGI scripts  
     160                    * any files opened during execution of CGI scripts  
     161                    * <GW>/ldap/web/log directory where output is written 
    161162         
    162163        ==== account: //nobody// ====    
    … …  
    183184                    * facilitate transfer of LDIF to uaasynch account 
    184185 
    185                 Note: Production "style" elements are copied from preproduction to the gateway  
     186                '''Note:''' Production "style" elements are copied from preproduction to the gateway  
    186187                directories; no reliance on links. 
    187188         
    … …  
    190191 
    191192        ==== group: SWLDAP ==== 
    192                 group used to share output of registry database batch processes where output is  
     193                Group used to share output of registry database batch processes where output is  
    193194                owned by oracle and written to /tmp 
    194195 
    … …  
    204205UNIX account under which EDIR Banner Extract processing occurs and from which registry generated LDIF originates.  All EDIR registry related source code is stored under this account.  
    205206         
    206                 Master - eklutna:~sxldap/local/ldap/ 
    207          
    208                 sxldap must be listed in ~iplanet/.shosts file to facilitate transfer  
    209                 and application of registry generated LDIF 
    210          
    211                 member of group SWLDAP (primary group) 
    212                 member of group UA_Korn 
    213  
    214          
    215  
    216 ORACLE ACCOUNTS/ROLES 
    217 ===================== 
    218  
    219         account: OPS$SXLDAP 
    220                 Oracle schema owning EDIR registry and performing EDIR Banner Extract 
    221                 processing. 
    222          
    223                 granted role CONNECT  
    224                 granted role LDAP_ROLE (role to which oracle SYS privs are granted) 
    225          
    226                 Note: Table grants are made directly to the OPS$SXLDAP account which  
     207                * Master - eklutna:~sxldap/local/ldap/ 
     208         
     209                * sxldap must be listed in ~iplanet/.shosts file to facilitate transfer and application of registry generated LDIF 
     210                * Group Membership 
     211                  * group SWLDAP (primary group) 
     212                  * group UA_Korn 
     213 
     214         
     215 
     216== ORACLE ACCOUNTS AND ROLES == 
     217 
     218        === account: //OPS$SXLDAP// === 
     219Oracle schema owning EDIR registry and performing EDIR Banner Extract processing. 
     220                * Roles  
     221                  * Granted role CONNECT  
     222                  * Granted role LDAP_ROLE (role to which oracle SYS privs are granted) 
     223         
     224                '''Note:''' Table grants are made directly to the OPS$SXLDAP account which  
    227225                in turn creates objects referencing those accounts.  See the following 
    228226                files on toklat:  
    … …  
    230228                        /ODS/product/PROD/bin/grant_*_to_sxldap.sql 
    231229 
    232         account: EDIR_GATEWAY 
     230        === account: //EDIR_GATEWAY// === 
    233231                Oracle schema granted execute and select privilege on OPS$SXLDAP owned  
    234232                registry procedures and views. 
    … …  
    236234                granted role EDIR_ROLE 
    237235 
    238         role: EDIR_ROLE 
     236        === role: EDIR_ROLE === 
    239237                Oracle role to which ops$sxldap can grant privileges so that EDIR_GATEWAY 
    240238                has access. 
    241239 
    242                 Note: Historically, all grants on OPS$SXLDAP objects are made to the  
     240                '''Note:''' Historically, all grants on OPS$SXLDAP objects are made to the  
    243241                EDIR_GATEWAY via the SQL source scripts for creating the objects.  We haven't 
    244                 been utilizing the role.  See summit:~sxldap/local/ldap/registry/*.sql 
    245  
    246          
    247 ############## 
    248 CHANGE HISTORY 
    249 ############## 
    250 20071031 elm    added section about oracle_[en|dis]able_updates.ksh scripts 
    251 20081114 elm    added reference to credentials, roles, ACIs soon to be associated  
    252                 with update back end under sxldap ownership rather than iplanet ownership 
    253  
    254 (eof)    
     242                been utilizing the role.  See eklutnat:~sxldap/local/ldap/registry/*.sql 
     243 
     244         
     245########################################################[[br]] 
     246LEGACY CHANGE HISTORY - '''NOTE:''' All subsequent changes are recorded in TracWiki[[br]] 
     247########################################################[[br]] 
     24820071031 elm    added section about oracle_[en|dis]able_updates.ksh scripts[[br]] 
     24920081114 elm    added reference to credentials, roles, ACIs soon to be associated with update back end under sxldap ownership rather than iplanet ownership