Changes between Version 8 and Version 9 of ALL__accounts_roles


Ignore:
Timestamp:
05/22/15 16:03:06 (10 years ago)
Author:
lttoth@…
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • ALL__accounts_roles

    v8 v9  
    1010=== iPlanet Accounts === 
    1111 
     12 
     13==== EDIR Web Gateway ==== 
     14The following credentials utilized by EDIR web gateway for "anonymous" access 
     15        * uid=edirgw03,ou=resource,dc=alaska,dc=edu 
     16 
     17The following credentials are utilized by EDIR web gateway to access privileged information not expected to be visible to "anonymous" access but need for functions like the "This is me! Log In" link. 
     18        * uid=edirpriv03,ou=resource,dc=alaska,dc=edu 
     19 
     20==== AUTHSERV Web Gateway ==== 
     21The following credentials are utilized by the AUTHSERV web gateway  
     22        * uid=authserv03,ou=resource,dc=alaska,dc=edu 
     23 
     24The following credentials are utilized by AUTHSERV web gateway to access privileged information  
     25        * uid=authpriv03,ou=resource,dc=alaska,dc=edu 
     26 
     27==== UPDATE ==== 
     28The following credentials are utilized by UPDATE interface for batch processing 
    1229        * uid=edirbatch03,ou=resource,dc=alaska,dc=edu 
    13                 credentials utilized by UPDATE interface for batch processing 
    14  
    15         * uid=edirgw03,ou=resource,dc=alaska,dc=edu 
    16                 credentials utilized by EDIR web gateway for "anonymous" access 
    17  
    18         * uid=edirpriv03,ou=resource,dc=alaska,dc=edu 
    19                 credentials utilized by EDIR web gateway to access privileged information  
    20                 not expected to be visible to "anonymous" access but need for functions  
    21                 like the "This is me! Log In" link. 
    22  
    23         * uid=authserv03,ou=resource,dc=alaska,dc=edu 
    24                 credentials utilized by the AUTHSERV web gateway  
    25  
    26         * uid=authpriv03,ou=resource,dc=alaska,dc=edu 
    27                 credentials utilized by AUTHSERV web gateway to access privileged information  
    28  
     30 
     31The following credentials are utilized by UPDATE back end to access privileged information and perform privileged tasks 
    2932        * uid=updategw03,ou=resource,dc=alaska,dc=edu 
    30                 credentials utilized by UPDATE back end to access privileged information  
    31                 and perform privileged tasks 
    32  
    33 Note: Most likely, AUTHSERV needs only one set of credentials. 
     33 
     34 
     35''Note:'' Most likely, AUTHSERV needs only one set of credentials. 
    3436 
    3537=== iPlanet Roles === 
    36          
     38==== Anonymous Access ==== 
     39The following roles are associated with ACIs allowing gateway access to non-privileged information       
    3740        * cn=directoryGatewayRole,ou=people,dc=alaska,dc=edu 
    3841        * cn=directoryGatewayRole,ou=resource,dc=alaska,dc=edu 
    39                  roles associated with ACIs allowing gateway access to non-privileged information 
    40  
     42 
     43==== Privileged Gateway Access ==== 
     44The following roles are associated with ACIs allowing gateway access to privileged information 
    4145        * cn=directoryPrivilegedRole,ou=people,dc=alaska,dc=edu 
    4246        * cn=directoryPrivilegedRole,ou=resource,dc=alaska,dc=edu 
    43                 roles associated with ACIs allowing gateway access to privileged information 
    44  
     47 
     48==== Non-Privileged Gateway Access ==== 
     49The following roles are associated with ACIs allowing gateway access to non-privileged information 
    4550        * cn=authserviceRole,ou=people,dc=alaska,dc=edu 
    4651        * cn=authserviceRole,ou=resource,dc=alaska,dc=edu 
    47                 roles associated with ACIs allowing gateway access to non-privileged information 
    48  
     52 
     53==== Privileged AUTHSERV Access ==== 
     54The following roles are associated with ACIs allowing authserv access to privileged information 
    4955        * cn=authservicePrivilegedRole,ou=resource,dc=alaska,dc=edu 
    5056        * cn=authservicePrivilegedRole,ou=people,dc=alaska,dc=edu 
    51                 roles associated with ACIs allowing gateway access to privileged information 
    52  
     57 
     58==== UPDATE ==== 
     59The following role is associated with ACIs allowing the update back end access to privileged information 
    5360        * (future) cn=superUserRole,ou=resource,dc=alaska,dc=edu 
    54                 role associated with ACIs allowing the update back end access to privileged information 
    5561 
    5662=== iPlanet ACIs === 
    57  
     63==== Non-Privileged Gateway Role ==== 
     64The following ACIs provide the non-privileged gateway role with read access to non-privileged information 
    5865        * EDIRGWANYCOMPARE 
    5966        * EDIRGWANYREAD 
    6067        * EDIRGWEMPREAD 
    6168        * EDIRGWSTUREAD 
    62                 ACIs that provide the non-privileged gateway role with read access to non-privileged 
    63                 information  
    64  
     69  
     70==== Privileged Gateway Roles ==== 
     71The following ACIs that provide the privileged gateway role the ability to ask true/false questions about attributes that are not otherwise visible 
    6572        * EDIRGWCOMPARE 
    6673        * EDIRGWEMPCOMPARE 
    6774        * EDIRGWSTUCOMPARE 
    68                 ACIs that provide the privileged gateway role the ability to ask true/false 
    69                 questions about attributes that are not otherwise visible 
     75                 
     76The following ACIs that provide the privileged gateway role with read access to privileged information           
    7077 
    7178        * EDIRGWPRIVREAD 
    72                 ACIs that provide the privileged gateway role with read access to privileged  
    73                 information 
     79 
     80==== Non-Privileged Authservice Role ==== 
     81The following ACIs that provide the non-privileged authserv role with read access to non-privileged information 
    7482 
    7583        * AUTHSERVICEREAD 
    76                 ACIs that provide the non-privileged authservice role with read access to non-privileged  
    77                 information 
     84 
     85==== Privileged Authservice Roles ====           
     86The following ACIs that provide the privileged authserv role the ability to ask true/false questions about attributes that are not otherwise visible 
    7887 
    7988        * AUTHSERVICEPRIVCOMPARE 
    80                 ACIs that provide the privileged gateway role the ability to ask true/false 
    81                 questions about attributes that are not otherwise visible 
    82  
     89 
     90The following ACIs that provide the privileged authserv role with read access to privileged information 
    8391        * AUTHSERVICEPRIVREAD 
    84                 ACIs that provide the privileged authservice role with read access to privileged information 
    85  
    86         (future) SUADDDEL 
    87         (future) SUDENYREADSEARCHCOMPARE 
    88         (future) SUDENYWRITE 
    89         (future) SUREADWRITE 
    90                 ACIs that provide (or deny) the privileged superuser role with read/write access 
    91                 to privileged information 
    92  
    93  
     92 
     93==== Privileged Superuser Role ==== 
     94Not Implemented:  The following ACIs would have provided (or denied) the privileged superuser role with read/write access to privileged information      
     95       * SUADDDEL 
     96       * SUDENYREADSEARCHCOMPARE 
     97       * SUDENYWRITE 
     98       * SUREADWRITE 
    9499 
    95100== UNIX GROUPS AND MEMBER ACCOUNTS == 
    … …  
    240245                '''Note:''' Historically, all grants on OPS$SXLDAP objects are made to the  
    241246                EDIR_GATEWAY via the SQL source scripts for creating the objects.  We haven't 
    242                 been utilizing the role.  See eklutnat:~sxldap/local/ldap/registry/*.sql 
     247                been utilizing the role.  See eklutnat:~sxldap/local/ldap/registry/*.sql[[br]] 
    243248 
    244249