Changes between Version 2 and Version 3 of ALL__security_ismemberof
- Timestamp:
- 11/26/14 16:37:26 (10 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
ALL__security_ismemberof
v2 v3 1 = ISMEMBEROF and Associated Group Records =1 = EDUISMEMBEROF and Associated Group Records = 2 2 Original author: Beth Mercer - 20081103 3 3 4 The isMemberOf is an attribute of the eduMember objectClass. The eduMember objectClass 5 is granted to every ou=people directory record when created. isMemberOf is 6 provisioned with individual group memberships that are in turn used by external 7 applications to make authorization based decisions. 4 ''Note:'' Originally, the ''isMemberOf'' attribute of the ''eduMember'' objectClass was used for Group Memberships. That attribute became intricately bound into the inner workings of the SUN LDAP product. For that reason, the following documentation now refers to ''isEduMemberOf'', the attribute that is used by University of Alaska to establish membership. 8 5 9 isMemberOf values are expected to tie to ou=group records of the same name although 10 there is currently no mechanism within the directory that forces that relationship. 11 So, it is currently possible to provision an isMemberOf value that matches no 12 group name. 6 The ''eduIsMemberOf'' is an attribute of the ''eduMember'' objectClass. At creation, the ''eduMember'' objectClass is granted to every directory record defined by 'people' organizational unit (ou=people). Provisioning ''isMemberOf'' is based upon individual group memberships that are in turn used by external applications to make authorization based decisions. 13 7 14 The mechanism by which ou=group records are created is the AUTHSERV Seed Group page: 8 ''Note:'' While ''eduIsMemberOf'' values are expected to tie to ou=group records of the same name although 9 there is currently no mechanism within the directory that forces that relationship. So, it is currently possible to provision an ''eduIsMemberOf'' value that does not match any existing group name. 15 10 16 https://authserv.alaska.edu/cgi-bin/seed_group 11 == Creating Group Records == 12 The mechanism by which group organizational unit (ou=group) records are created is the AUTHSERV Seed Group page: 13 14 * https://authserv.alaska.edu/cgi-bin/seed_group 17 15 18 16 That CGI script creates both the directory group record as well as a registry 19 17 record to track the group. 20 18 21 The mechanism by which isMemberOf values are provisioned is presently ZUAUSR. 22 However, ZUAUSR is an application that performs provisioning for administrative 19 == Provisioning Group Membership == 20 The mechanism by which ''eduIsMemberOf'' values are provisioned is presently ZUAUSR. 21 The limitation with that tool is that ZUAUSR is an application that performs provisioning for administrative 23 22 users which historically have been only employees and select vendors. 24 23 25 If/when the use of group records and the isMemberOf attribute is extended to serve a 24 === Provisioning Strategies Not Reliant on ZUAUSR === 25 If/when the use of group records and the ''eduIsMemberOf'' attribute is extended to serve a 26 26 population of non-employees, then other mechanisms for provisioning will need to be 27 27 created. When that comes to pass, it is recommended that different consituent groups 28 28 be protected from each other's activities by creating security objects that scope 29 access to group record creation and isMemberOfprovisioning.29 access to group record creation and ''eduIsMemberOf'' provisioning. 30 30 31 31 That can be accomplished as follows: 32 32 33 1) Create new EDIRrole values specific to particular applications/provisioning processes 34 35 EDIRrole: groupAdmin<pattern> 36 37 2) Create new iPlanet roles specific to each new EDIRrole 38 39 3) Create ACIs tied to the new iPlanet roles in which the scope of the access 33 1. Create new EDIRrole values specific to particular applications/provisioning processes 34 * EDIRrole: groupAdmin<pattern> 35 1. Create new iPlanet roles specific to each new EDIRrole 36 1. Create ACIs tied to the new iPlanet roles in which the scope of the access 40 37 is defined in a targattrfilters clause which limits access to group names 41 38 beginning with <pattern> 42 39 43 40 EXAMPLE: 44 41 {{{ 45 42 # EDIRrole value 46 43 groupAdminAppA … … 56 53 nsRoleFilter: (&(EDIRROLE=*)(EDIRrole=groupAdminAppA)(eduPersonAffiliation=Employee)(assignmentCount=*)(!(assignmentCount=0))) 57 54 Description: filtered role for entities allowed to define groups and provision membership for AppA 55 }}} 56 57 === ACI Snippet for Group Record !Creation/Deletion === 58 59 (targattrfilters="add=cn:(cn=appusers:AppA:*), del=cn:(cn=appusers:AppA:*)") 60 allow (compare,read,write,search) (roledn="ldap:///cn=groupAdminAppARole,ou=people,dc=alaska,dc=edu" and (ip=<''iPlanet LDAP server''>);) 58 61 59 # ACI snippet for group record creation/deletion 60 (targattrfilters="add=cn:(cn=appusers:AppA:*), del=cn:(cn=appusers:AppA:*)") 61 allow (compare,read,write,search) (roledn="ldap:///cn=groupAdminAppARole,ou=people,dc=alaska,dc=edu" and (ip="137.229.9.17 || 137.229.9.68 || 137.229.9.71 || 137.229.9.75"));) 62 62 === ACI Snippet for ''eduIsMemberOf'' Updates === 63 (targattrfilters="add=isMemberOf:(isMemberOf=cn=appusers:AppA:*), del=isMemberOf:(isMemberOf=cn=appusers:AppA:*)") 64 allow (compare,read,write,search) (roledn="ldap:///cn=groupAdminAppARole,ou=people,dc=alaska,dc=edu" and (ip=<''iPlanet LDAP server''>);) 63 65 64 # ACI snippet for isMemberOf updates 65 (targattrfilters="add=isMemberOf:(isMemberOf=cn=appusers:AppA:*), del=isMemberOf:(isMemberOf=cn=appusers:AppA:*)") 66 allow (compare,read,write,search) (roledn="ldap:///cn=groupAdminAppARole,ou=people,dc=alaska,dc=edu" and (ip="137.229.9.17 || 137.229.9.68 || 137.229.9.71 || 137.229.9.75"));) 66 === Pattern of Group Names and ''eduIsMemberOf'' Values to Which ACIs Apply === 67 67 68 # pattern of group names and isMemberOf values to which ACIs apply69 68 cn=appusers:AppA:*,ou=group,dc=alaska,dc=edu 70 69 71 72 In the example, the assumption is still that group and isMemberOf maintenance for 70 In the example, the assumption is still that group and ''eduIsMemberOf'' maintenance for 73 71 AppA is being delegated to a univeristy employee who's account can be provisioned 74 72 via ZUAUSR. If instead responsibility is to be delegated to an application, then 75 73 the iPlanet role needs to be stuctured for use by ou=resource records. 76 74 77 Should applications have a need to independently delgate group and isMemberOf75 Should applications have a need to independently delgate group and ''eduIsMemberOf'' 78 76 maintenance for their own pattern of group names, then iPlanet roles should be created 79 that rely on a specific **isMemberOf**values rather than EDIRrole values. Then who80 ever was granted a key isMemberOfvalue could in turn grant other users the same81 isMemberOf value, there by delgating group/isMemberOf maintenance authority.77 that rely on a specific ''eduIsMemberOf'' values rather than EDIRrole values. Then who 78 ever was granted a key ''eduIsMemberOf'' value could in turn grant other users the same 79 ''eduIsMemberOf'' value, there by delgating !group/eduIsMemberOf maintenance authority. 82 80 83 NOTE:EDIRrole values can not be used to facilitate delegation of delegated authority81 ''NOTE:'' EDIRrole values can not be used to facilitate delegation of delegated authority 84 82 as only users with EDIRadmin can provision EDIRrole values and EDIRadmin will 85 **NOT** be granted to individuals managing group/isMemberOf for specific applications. 86 87 # eof 83 **NOT** be granted to individuals managing !group/eduIsMemberOf for specific applications.
