Changes between Initial Version and Version 1 of ALL__security_acis


Ignore:
Timestamp:
11/20/14 17:21:10 (10 years ago)
Author:
lttoth@…
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • ALL__security_acis

    v1 v1  
     1   Original Author:  Mark Anderson - 20081204  
     2 
     3== Steps to create ACIs == 
     4 
     5=== 1. Determine Method for Creating ACI === 
     6You may find it easiest to create the ACI first from scratch in Test and then to enter it into the ACI workbook afterwards so that it can be documented there.  Alternatively you can start with the workbook in step 2. 
     7 
     8=== 2. Identify Current ACI Workbook === 
     9Identify the most recent ACI workbook in the Chinook\Dirsrvsptgp\ACIs\ folder, e.g. ACI_worksheet_20081105mpa.   
     10=== 3. Open the ACI Workbook === 
     11Save it immediately as an ACI workbook suffixed with the current date.  
     12=== 4. Add a Row for the ACI to the ACI Type Lookup Tabbed Page === 
     13The left-hand column of the row is a name for the ACI, chosen by you.  The right-hand column is a very short description of the ACI.  If you modify the ACI Attribs tabbed page later in this procedure, this description will appear beside each attribute exposed by the ACI when you enter that attribute's row on the page. 
     14 
     15==== Naming New ACIs ==== 
     16    The convention I am currently using is to name a new ACI after the application or  resource account that prompted its creation (e.g. SHIBBOLETHREAD).  This helps show that the purpose of  the ACI is to support that particular application.  If later the privileges of this application must be changed, the application-specific name will attract attention to the ACI as a candidate for the new privileges. 
     17 
     18    If on the other hand the ACI is used for a second application or resource account, I change the ACI name to one which describes the ACI's characteristics (e.g. UASYSTEMIDREAD).  This helps show that the ACI is shared by several applications and that changing it requires re-checking the needs of all those applications. 
     19 
     20    Not all existing ACIs are named using this convention. 
     21 
     22==== ACI Scope ==== 
     23    At the start of the EDIR project, emphasis was placed on reusing ACIs to slow their proliferation.  In general, I have not been able to realize this goal.  An individual resource account typically has different needs than any other resource account.  If an existing ACI meets most but not all of the needs of a new resource account, then it must be supplemented by another ad hoc ACI whose scope is very specialized and which probably cannot be reused.  The addition of the ad hoc ACI also defeats the purpose of slowing the proliferation of ACIs.  If, on the other hand, an existing ACI meets the needs of a new resource account and provides other access besides, then associating that ACI with that account violates the principle of least privilege.  In general, then, expect to create a new ACI for each new resource account. 
     24 
     25==== ACI Dependence ==== 
     26    In the past, when creating a new ACI, I have first checked to see which of the desired attributes were already exposed to anonymous query and then constructed the new ACI using only the remaining  attributes.  In retrospect it seems to me it would be better to not assume that an attribute is going to remain visible to the public but rather to include all the desired attributes in the ACI. 
     27 
     28=== 5. Determine Intended Permissions for ACI === 
     29If the new ACI is intended to allow "read", "compare", "search" and/or  "write" -- that is, it is an ACI that exposes attributes -- then you will need to modify both the ACI Logic and the ACI Attribs tabbed pages.  If the new ACI is intended to allow "add" and "delete", or is some other ACI that does not expose attributes,  then you will need to modify only the ACI Logic tab.   
     30=== 6. Modify ACI Tabbed Pages === 
     31==== Modify the ACI Attribs tabbed page ==== 
     32If your planned ACI requires attribute modification, it does not matter where in this page you add your new row(s), since the page will be automatically re-sorted later by the macro which writes the LDIF. 
     33 
     34For each attribute that is to be exposed by the ACI, create a spreadsheet row consisting of: 
     35  
     36      * ACI LABEL:   The name of the ACI you are constructing, chosen by you in step 4.  You will also use this name later, on the ACI Logic page. 
     37 
     38      * OU1 and OU2:    These always have the same value; the duplication is needed by the macro for some reason.  The value is the branch of the LDAP directory that the ACI will inhabit and grant permissions upon (or enforce restrictions upon).  It will be one of PEOPLE, RESOURCE, DEPARTMENTS, ROUTING.  You will also use this value later on the ACI Logic page. 
     39 
     40     *  ACI TARGET ATTRIBUTE:   An existing EDIR/AUTHSERV attribute that is to be exposed by the planned ACI. 
     41 
     42      * EXISTS:   This is always X.  This X is purely a marker which later appears on the pivot table of the Pivot tabbed page. 
     43 
     44      * ATTRIB TYPE and ACI TYPE:   Do not fill in a constant value in these columns.  Instead copy-and-paste the VLOOKUP() function invocations from a preexisting row's ATTRIB TYPE and ACI TYPE  columns into the new row's ATTRIB TYPE and ACI TYPE columns. 
     45 
     46==== Modify the ACI Logic tabbed page ====   
     47It does not matter where in this page you add your new row, since the page will be automatically re-sorted later by the macro which writes the LDIF.  In the new row, fill in: 
     48 
     49      * ACI OU:   The branch of the LDAP directory that the planned ACI will inhabit and grant permissions upon (or 
     50               enforce restrictions upon).  It will be one of PEOPLE, RESOURCE, DEPARTMENTS, ROUTING.   You used  
     51               this value earlier on the ACI Attribs page. 
     52 
     53      * ACI LABEL:   The name of the ACI you are constructing, chosen by you.  You used this name earlier on the  
     54                  ACI Attribs page. 
     55 
     56      * ACI Mode:   "allow" or "deny", depending on whether the planned ACI grants access or blocks access. 
     57 
     58      * ACI Permissions:   the interrogation (search, read, compare) or update (add, delete, write) operations granted  
     59                        or blocked by the planned ACI. 
     60 
     61      * ACI Bind Rule:   regular expression which describes who the planned ACI applies to.  Typically includes one or  
     62                      more of  
     63 
     64                      roledn  e.g. ldap:///cn=fooRole,ou=resource,dc=alaska,dc=edu 
     65                      ip      IP address from which LDAP operation originates 
     66                      userdn  e.g. ldap:///anyone 
     67 
     68                      If you choose to use roledn, the cn (foorole in the example above) will be the same as the value  
     69                      of an EDIRROLE attribute.  This EDIRROLE will later be assigned to the accounts who are targeted  
     70                      by the ACI.  I have so far created a new role for each new ACI and have named it after the ACI. 
     71 
     72                      If you rename the ACI, there may be no point in renaming the corresponding role and changing the  
     73                      EDIRROLE values assigned to each of the affected accounts, expecially if the role name is 
     74                      usefully descriptive; it may be better to create a new descriptively-named role and EDIROLE value 
     75                      and link both roles to the ACI in this step. 
     76 
     777.  Invoke the macro which constructs the entire set of ACI creation commands from the ACI Attribs and ACI Logic  
     78    tabbed pages: 
     79 
     80      SHIFT+CONTROL+L 
     81 
     82    In the resulting dialog box, accept the default of ALL OUs and click OK.  This will build the ACI creation commands  
     83    in LDIF on the LDIF tabbed page.  When the macro completes, save the workbook with all your changes. 
     84 
     858.  Transfer the ACI creation commands from the LDIF tabbed page of the spreadsheet to a text file on a directory host. 
     86 
     87    On any "e" box, as UNIX user iplanet 
     88 
     89      cd /export/home/iplanet/local/ldap/schema/ACI 
     90      ls -ltr 
     91 
     92    Note the most recent ACI creation file in the directory.  The name will be of the form 
     93 
     94      user_update.<yyyymmdd><initials>_<description of changes to ACI> 
     95 
     96    If you introduce some problem into the directory with your new ACI, you will use this older ACI file to restore the  
     97    directory to its previous state.  
     98 
     99    Open a new ACI file with your favorite text editor. Copy-and-paste the entire content of the LDIF tabbed page of the  
     100    spreadsheet into the file. 
     101 
     1029.  Add the new ACI to the Test directory by dropping and recreating all ACIs in that instance.  
     103 
     104      apply_acisTest.ksh  <your ACI file name> 
     105 
     106    apply_acisTest.ksh is in /export/home/iplanet/local/ldap/scripts, and writes standard output and standard error,  
     107    respectively, to the files apply_acisTest.out and apply_acisTest.err in that directory. 
     108 
     109    After apply_acisTest.ksh completes, review its standard error in apply_acisTest.err.  A single line like this is an  
     110    expected, ignorable error: 
     111 
     112      ldap_modify: No such attribute 
     113 
     114    Any other errors represent problems with the ACI file which must be corrected.  If they cannot be resolved, roll back  
     115    the changes you made by dropping and recreating all ACIs with the previous ACI file you identified in Step 4 above. 
     116 
     117    N.B. The ignorable error is caused by the first command in the ACI file, which attempts to drop all ACIs in the root  
     118    of the directory tree (dn: dc=Alaska,dc=edu).  Normally there are no ACIs there. 
     119 
     12010. Make the ACI change visible to the EDIR and AUTHSERV gateways by running the following two scripts on all of the "e" 
     121    boxes (or at least on those "e" boxes serving EDIR/AUTHSERV, which are currently egegik and eklutna).  The gateways  
     122    cannot see the ACIs inside the LDAP server and so depend on the files updated by these scripts to find out what  
     123    updateable fields they should show to users.  These scripts will be run every morning via Appworx if you miss this step: 
     124 
     125      (as iplanet) ~iplanet/local/ldap/scripts/static_list_maint.ksh Test 
     126      (as ldapgw)  ~ldapgw/local/scripts/static_list_maint.ksh Test 
     127 
     12811. If you defined the ACI on the ACI Logic tabbed page using a roledn in the ACI bind rule, e.g. 
     129 
     130      ldap:///cn=fooRole,ou=resource,dc=alaska,dc=edu 
     131 
     132    Then you will need to create an iPlanet role with that DN.  This role that you create will include an EDIRrole name,  
     133    chosen by you, which you can grant to a resource or people account.   This is the mechanism that links the ACI you created 
     134    to an account which will benefit from or be restricted by the ACI: the ACI names an iPlanet role, the iPlanet role names a 
     135    EDIRrole, and the EDIRrole is an attribute of the account. 
     136 
     137    Create the entry for the role.  The name you choose for the EDIRrole does not need to be the same name as the cn you already  
     138    chose for the iPlanet role, but if the EDIRrole will only comprise one iPlanet role then it may be the simplest naming  
     139    convention to follow. 
     140 
     141        dn: cn=<name of iPlanet role, e.g. fooRole>,ou=resource,dc=alaska,dc=edu 
     142        objectclass: top 
     143        objectclass: LDAPsubentry 
     144        objectclass: nsRoleDefinition 
     145        objectclass: nsComplexRoleDefinition 
     146        objectclass: nsFilteredRoleDefinition 
     147        cn: <name of iPlanet role, e.g. fooRole> 
     148        nsRoleFilter: (&(EDIRROLE=*)(EDIRrole=<name of EDIRrole, e.g. fooRole)) 
     149        Description: filtered role for <purpose of iPlanet role, i.e. what does underlying ACI allow or forbid> 
     150 
     151    Feed the LDIF above to the directory with ldap_add<Instance>, e.g. ldap_addTest < myFile.ldif. 
     152 
     153    The role will replicate to all the other LDAP servers.  Place the LDIF in ~iplanet/local/ldap/schema/ROLE/ on all the  
     154    "e" hosts for possible future reference. 
     155 
     156    Now grant the EDIRrole to the people or resource account which you want to benefit from (or be restricted by) the ACI you 
     157    created: 
     158 
     159        dn: uid=<uid of people or resource account>,ou=<resource or people, as appropriate>,dc=alaska,dc=edu 
     160        changetype: modify 
     161        add: EDIRrole 
     162        EDIRrole: <name of edirRole, e.g. fooRole> 
     163 
     164    Feed the LDIF above to the directory with ldap_modify<Instance>, e.g. ldap_modifyTest. 
     165 
     16612. Test the new ACI.  If it works correctly, promote the new ACI to Prep and Production in turn by repeating Step 5 with  
     167    the apply_acisPrep.ksh and apply_acisProd.ksh scripts.  If the ACI does not and cannot be made to work correctly, roll  
     168    back the changes you made by dropping and recreating all ACIs with the previous ACI file you identified in Step 4 above. 
     169    Note that defined the ACI on the ACI Logic tabbed page using a roledn in the ACI bind rule, you will need to create an  
     170    EDIRrole and assign it to the  
     171 
     17213. Copy the ACI file you created to the other directory hosts so that it will be available as the rollback ACI file for the 
     173    next person who creates an ACI. 
     174 
     175      ACIfile=<name of the ACI file you created> 
     176      for host in eklutna elias edgar egegik ; do 
     177         # only if not the host you're working from 
     178         if [[ "$host" != $(hostname) ]] ; then 
     179            echo "#### $host ####" 
     180            scp -p $ACIfile $host:/export/home/iplanet/local/ldap/schema/ACI/. 
     181         fi 
     182      done 
     183 
     184####################### 
     185DOCUMENT CHANGE HISTORY 
     186 
     18720090731 mpa  Somehow managed to permanently enable macros, so removed the steps for enabling them each time workbook is  
     188              opened. 
     18920090707 mpa  Added steps to  
     190              - advise that ad hoc creation of ACI may be the best first step. 
     191              - modify ACI Type Lookup tabbed page. 
     192              - create entry for iPlanet role and EDIRrole. 
     19320090210 mpa  Added step to run static_list_maint.ksh scripts.