Changes between Version 3 and Version 4 of ALL__security_acis


Ignore:
Timestamp:
11/24/14 16:57:36 (10 years ago)
Author:
lttoth@…
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • ALL__security_acis

    v3 v4  
    7979                      and link both roles to the ACI in this step. 
    8080 
    81 ===7.  Invoke the macro which constructs the entire set of ACI creation commands === 
    82  from the ACI Attribs and ACI Logic tabbed pages: 
     81=== 7.  Invoke the macro which constructs the entire set of ACI creation commands === 
     82This macro is invoked from the ACI Attribs and ACI Logic tabbed pages: 
    8383 
    84       SHIFT+CONTROL+L 
     84      * SHIFT+CONTROL+L 
    8585 
    86     In the resulting dialog box, accept the default of ALL OUs and click OK.  This will build the ACI creation commands  
    87     in LDIF on the LDIF tabbed page.  When the macro completes, save the workbook with all your changes. 
     86In the resulting dialog box, accept the default of ALL OUs and click OK.  This will build the ACI creation commands in LDIF on the LDIF tabbed page.  When the macro completes, save the workbook with all your changes. 
    8887 
    8988=== 8.  Transfer the ACI creation commands from the LDIF tabbed page === 
    90  of the spreadsheet to a text file on a directory host. 
     89Transfer from the LDIF tabbed pageof the spreadsheet to a text file on a directory host. 
    9190 
    92     On any "e" box, as UNIX user iplanet 
    93  
    94       cd /export/home/iplanet/local/ldap/schema/ACI 
    95       ls -ltr 
    96  
    97     Note the most recent ACI creation file in the directory.  The name will be of the form 
    98  
     91    1. On any "e" box, as UNIX user iplanet 
     92      * cd /export/home/iplanet/local/ldap/schema/ACI 
     93      * ls -ltr 
     94    1. Note the most recent ACI creation file in the directory.  The name will be of the form 
    9995      user_update.<yyyymmdd><initials>_<description of changes to ACI> 
    100  
    101     If you introduce some problem into the directory with your new ACI, you will use this older ACI file to restore the  
    102     directory to its previous state.  
    103  
    104     Open a new ACI file with your favorite text editor. Copy-and-paste the entire content of the LDIF tabbed page of the  
    105     spreadsheet into the file. 
     96    1. If you introduce some problem into the directory with your new ACI, you will use this older ACI file to restore the directory to its previous state.  
     97    1. Open a new ACI file with your favorite text editor. Copy-and-paste the entire content of the LDIF tabbed page of the spreadsheet into the file. 
    10698 
    10799=== 9.  Add the new ACI to the Test directory === 
    108 by dropping and recreating all ACIs in that instance.  
     100Accomplish this by dropping and recreating all ACIs in that instance.  
    109101 
    110       apply_acisTest.ksh  <your ACI file name> 
     102    1. apply_acisTest.ksh  <your ACI file name> 
     103    1. apply_acisTest.ksh is in /export/home/iplanet/local/ldap/scripts, and writes standard output and standard error, respectively, to the files apply_acisTest.out and apply_acisTest.err in that directory. 
     104    1. After apply_acisTest.ksh completes, review its standard error in apply_acisTest.err.  A single line like this is an  
     105    expected, ignorable error: 
     106      *  ldap_modify: No such attribute 
    111107 
    112     apply_acisTest.ksh is in /export/home/iplanet/local/ldap/scripts, and writes standard output and standard error,  
    113     respectively, to the files apply_acisTest.out and apply_acisTest.err in that directory. 
     108Any other errors represent problems with the ACI file which must be corrected.  If they cannot be resolved, roll back the changes you made by dropping and recreating all ACIs with the previous ACI file you identified in Step 4 above. 
    114109 
    115     After apply_acisTest.ksh completes, review its standard error in apply_acisTest.err.  A single line like this is an  
    116     expected, ignorable error: 
    117  
    118       ldap_modify: No such attribute 
    119  
    120     Any other errors represent problems with the ACI file which must be corrected.  If they cannot be resolved, roll back  
    121     the changes you made by dropping and recreating all ACIs with the previous ACI file you identified in Step 4 above. 
    122  
    123     N.B. The ignorable error is caused by the first command in the ACI file, which attempts to drop all ACIs in the root  
    124     of the directory tree (dn: dc=Alaska,dc=edu).  Normally there are no ACIs there. 
     110N.B. The ignorable error is caused by the first command in the ACI file, which attempts to drop all ACIs in the root of the directory tree (dn: dc=Alaska,dc=edu).  Normally there are no ACIs there. 
    125111 
    126112=== 10. Make the ACI change visible to the EDIR and AUTHSERV gateways === 
    127  by running the following two scripts on all of the "e" 
    128     boxes (or at least on those "e" boxes serving EDIR/AUTHSERV, which are currently egegik and eklutna).  The gateways  
    129     cannot see the ACIs inside the LDAP server and so depend on the files updated by these scripts to find out what  
    130     updateable fields they should show to users.  These scripts will be run every morning via Appworx if you miss this step: 
     113Running the following two scripts on the "E" boxes (or at least on those "E" boxes serving EDIR/AUTHSERV, which are currently egegik and eklutna).  make ACI changes visible to the gateways.  The gateways cannot see the ACIs inside the LDAP server and so depend on the files updated by these scripts to find out what updateable fields they should show to users.  These scripts will be run every morning via Appworx if you miss this step: 
    131114 
    132       (as iplanet) ~iplanet/local/ldap/scripts/static_list_maint.ksh Test 
    133       (as ldapgw)  ~ldapgw/local/scripts/static_list_maint.ksh Test 
     115      * AS iPLANET: ~iplanet/local/ldap/scripts/static_list_maint.ksh Test 
     116      * AS LDAPGW:   ~ldapgw/local/scripts/static_list_maint.ksh Test 
    134117 
    135 === 11. Special Cases === 
     118=== 11. Special Case === 
    136119 
    137 If you defined the ACI on the ACI Logic tabbed page using a roledn in the ACI bind rule, e.g. 
    138  
    139       ldap:///cn=fooRole,ou=resource,dc=alaska,dc=edu 
    140  
    141     Then you will need to create an iPlanet role with that DN.  This role that you create will include an EDIRrole name,  
    142     chosen by you, which you can grant to a resource or people account.   This is the mechanism that links the ACI you created 
    143     to an account which will benefit from or be restricted by the ACI: the ACI names an iPlanet role, the iPlanet role names a 
    144     EDIRrole, and the EDIRrole is an attribute of the account. 
    145  
    146     Create the entry for the role.  The name you choose for the EDIRrole does not need to be the same name as the cn you already  
    147     chose for the iPlanet role, but if the EDIRrole will only comprise one iPlanet role then it may be the simplest naming  
    148     convention to follow. 
    149  
    150         dn: cn=<name of iPlanet role, e.g. fooRole>,ou=resource,dc=alaska,dc=edu 
    151         objectclass: top 
    152         objectclass: LDAPsubentry 
    153         objectclass: nsRoleDefinition 
    154         objectclass: nsComplexRoleDefinition 
    155         objectclass: nsFilteredRoleDefinition 
    156         cn: <name of iPlanet role, e.g. fooRole> 
    157         nsRoleFilter: (&(EDIRROLE=*)(EDIRrole=<name of EDIRrole, e.g. fooRole)) 
    158         Description: filtered role for <purpose of iPlanet role, i.e. what does underlying ACI allow or forbid> 
    159  
    160     Feed the LDIF above to the directory with ldap_add<Instance>, e.g. ldap_addTest < myFile.ldif. 
    161  
    162     The role will replicate to all the other LDAP servers.  Place the LDIF in ~iplanet/local/ldap/schema/ROLE/ on all the  
    163     "e" hosts for possible future reference. 
    164  
    165     Now grant the EDIRrole to the people or resource account which you want to benefit from (or be restricted by) the ACI you 
    166     created: 
    167  
    168         dn: uid=<uid of people or resource account>,ou=<resource or people, as appropriate>,dc=alaska,dc=edu 
    169         changetype: modify 
    170         add: EDIRrole 
    171         EDIRrole: <name of edirRole, e.g. fooRole> 
    172  
    173     Feed the LDIF above to the directory with ldap_modify<Instance>, e.g. ldap_modifyTest. 
     120You defined the ACI on the ACI Logic tabbed page using a roledn in the ACI bind rule as follows: 
     121      
     122    *  ldap:///cn=fooRole,ou=resource,dc=alaska,dc=edu 
     123==== Actions ==== 
     124    1. You will need to create an iPlanet role with that DN.  This role that you create will include an EDIRrole name, chosen by you, which you can grant to a resource or people account.   This is the mechanism that links the ACI you created to an account which will benefit from or be restricted by the ACI: the ACI names an iPlanet role, the iPlanet role names a EDIRrole, and the EDIRrole is an attribute of the account. 
     125    1. Create the entry for the role.  The name you choose for the EDIRrole does not need to be the same name as the cn you already chose for the iPlanet role, but if the EDIRrole will only comprise one iPlanet role then it may be the simplest naming convention to follow. 
     126        * dn: cn=<name of iPlanet role, e.g. fooRole>,ou=resource,dc=alaska,dc=edu 
     127        * objectclass: top 
     128        * objectclass: LDAPsubentry 
     129        * objectclass: nsRoleDefinition 
     130        * objectclass: nsComplexRoleDefinition 
     131        * objectclass: nsFilteredRoleDefinition 
     132        * cn: <name of iPlanet role, e.g. fooRole> 
     133        * nsRoleFilter: (&(EDIRROLE=*)(EDIRrole=<name of EDIRrole, e.g. fooRole)) 
     134        * Description: filtered role for <purpose of iPlanet role, i.e. what does underlying ACI allow or forbid> 
     135 1. Feed the LDIF above to the directory with ldap_add<Instance>, e.g. ldap_addTest < myFile.ldif. 
     136        * The role will replicate to all the other LDAP servers.  Place the LDIF in ~iplanet/local/ldap/schema/ROLE/ on all the "E" hosts for possible future reference. 
     1371. Now grant the EDIRrole to the people or resource account which you want to benefit from (or be restricted by) the ACI you created: 
     138        * dn: uid=<uid of people or resource account>,ou=<resource or people, as appropriate>,dc=alaska,dc=edu 
     139        * changetype: modify 
     140        * add: EDIRrole 
     141        * EDIRrole: <name of edirRole, e.g. fooRole> 
     1421. Feed the LDIF above to the directory with ldap_modify<Instance>, e.g. ldap_modifyTest. 
    174143 
    175144=== 12. Test the new ACI. === 
    176145 If it works correctly, promote the new ACI to Prep and Production in turn by repeating Step 5 with  
    177     the apply_acisPrep.ksh and apply_acisProd.ksh scripts.  If the ACI does not and cannot be made to work correctly, roll  
    178     back the changes you made by dropping and recreating all ACIs with the previous ACI file you identified in Step 4 above. 
    179     Note that defined the ACI on the ACI Logic tabbed page using a roledn in the ACI bind rule, you will need to create an  
    180     EDIRrole and assign it to the  
     146the apply_acisPrep.ksh and apply_acisProd.ksh scripts.  If the ACI does not and cannot be made to work correctly, roll back the changes you made by dropping and recreating all ACIs with the previous ACI file you identified in Step 4 above. 
     147     
     148Note that defined the ACI on the ACI Logic tabbed page using a roledn in the ACI bind rule, you will need to create an EDIRrole and assign it to the  
    181149 
    182150=== 13. Copy the ACI file you created to the other directory hosts ===