Changes between Version 2 and Version 3 of ALL__security_access_control
- Timestamp:
- 11/20/14 15:21:41 (10 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
ALL__security_access_control
v2 v3 4 4 See also: 5 5 6 https://donnelly.alaska.edu/docs/LDAP/ALL__security7 https://donnelly.alaska.edu/docs/LDAP/ALL__security_account_admin6 [[ALL__security| Directory Related Security]][[br]] 7 [[ALL__security_account_admin| Directory Account Administration ]] 8 8 9 9 Because EDIR/AUTHSERV are comprised of a loosely coupled set of CGI scripts (the web … … 11 11 restrictions on access control are implemented in a number of ways. 12 12 13 ## Directory ACIs and Schema ## 13 == Directory ACIs and Schema == 14 14 15 15 The primary mechanism for restricting access are the iPlanet directory ACIs. Those ACIs 16 dictate who may READ, WRITE, SEARCH and COMPARE directory data. No matter what mechanism 17 is used to access directory data, the underlying ACIs limit what is possible. 16 dictate who may READ, WRITE, SEARCH and COMPARE directory data. No matter what mechanism is used to access directory data, the underlying ACIs limit what is possible. 18 17 19 18 However, the directory ACIs as currently established do not cover all functions resulting … … 28 27 29 28 30 ## EDIRrole Attribute and iPlanet Roles ## 29 == EDIRrole Attribute and iPlanet Roles == 31 30 32 31 EDIRrole is a locally defined attribute used in the definition of iPlanet roles which in … … 36 35 access (ability to update some department records but not others). 37 36 38 NOTE:EDIRrole grants are managed via normal administrative channels (ZUAUSR).37 ''NOTE:'' EDIRrole grants are managed via normal administrative channels (ZUAUSR). 39 38 40 41 ## Web Gateway CGI Scripts ## 39 == Web Gateway CGI Scripts == 42 40 43 41 In addition to being used in the definition of iPlanet roles which are in turn used to … … 58 56 59 57 60 ## Update Back End ## 58 == Update Back End == 61 59 62 60 All updates of self service attributes are ultimately processed by a back end web site … … 70 68 access. The other point where business rules are appropriately enforced is the Oracle registry. 71 69 72 73 ## Oracle Registry ## 70 == Oracle Registry == 74 71 75 72 The Oracle registry is the primary mechanism by which business rules are enforced during … … 81 78 In September of 2008, three attributes were excluded from the process of two step updates 82 79 and so now bypass the Oracle registry: uakUserPassword, uakSecQuestion and uakSecResponse. 83 The business rules formerly enforced by the Oracle registry are now enforced via the update 84 back end (see note above). 80 The business rules formerly enforced by the Oracle registry are now enforced by a separate application, ELMO. 85 81 86 82 ########################################################[[br]] … … 90 86 20081031 elm corrected typo 91 87 20081103 elm added "See also:" with links to other security related docs 92 93 #eof
