18.2. ACI Placement
Directory Server stores ACIs in the multi-valued
aci operational attribute in directory entries. To set an ACI, add the aci attribute to the corresponding directory entry. Directory Server applies the ACIs:
- Only to the entry that contains the ACI, if it does not have any child entries. For example, if a client requires access to the
uid=user_name,ou=People,dc=example,dc=comobject, and an ACI is only set ondc=example,dc=comand not on any child entries, only this ACI is applied.Note
ACIs withaddpermissions also apply to child entries created in future. - To the entry that contains the ACI and to all entries below it, if it has child entries. As a direct consequence, when the server evaluates access permissions to any given entry, it verifies the ACIs for every entry between the one requested and the directory suffix, as well as the ACIs on the entry itself.For example, ACIs are set on the
dc=example,dc=comand theou=People,dc=example,dc=comentry: If a client wants to access theuid=user_name,ou=People,dc=example,dc=comobject, which has no ACI set, Directory Server first creates a set with the ACIs fromdc=example,dc=comandou=People,dc=example,dc=com. Directory Server builds the list of applicable ACIs bottom-up from the target entry up to the top suffix. However, consider this list as a set, and the client application should not anticipate any order into ACI evaluation.The server selects the ACIs that match the resource entry that creates the final set of applicable ACIs from this initial set. Then it first evaluates the ACIs that deny permission. If aDENYACI has been successfully evaluated, the operation fails. If noDENYACI is found, Directory Server checks if an ACI exists that grantsALLOWpermissions. If at least one of the ACIs allows access, Directory Server grants access. If no ACI grantsALLOWpermissions, Directory Server refuses access, and the operation fails.
Note
ACIs set in the
rootDSE entry apply only to this entry.
An ACI created on an entry can be set not to apply directly to that entry but rather to some or all of the entries in the subtree below. The advantage of this approach is that general ACIs can be placed higher in the directory tree to have effect on entries located lower in the tree. For example, an ACI that targets entries that include the
inetOrgPerson object class can be created at the level of an organizationalUnit entry or a locality entry.
Note
Minimize the number of ACIs in the directory tree by placing general rules at high level branch points. To limit the scope of more specific rules, place them to leaf entries as closely as possible.
