Contents      Dochome     
Sun Java(TM) System Directory Server Online Help



Effective Rights Dialog

This dialog box displays the effective access rights of the chosen user to the chosen attributes in the given entry.

Attribute Level Tab

This tab displays the user's effective access rights to each of the selected attributes, as determined by the ACIs defined in the server that target this entry and the given attributes.

Attribute Name. This column contains the attribute names selected in the previous dialog.

A check in the columns listed below indicates that the user has the described access right for the attribute in the corresponding row. An empty checkbox indicates that the user does not have that right.

Search. The user has the right to search this entry based on the value of this attribute.

Read. This attribute and its value will be returned to the user if this entry is in the result of a search.

Compare. The user is allowed to perform LDAP compare operations on this entry based on the value of this attribute.

Proxy. The user may perform operations on this attribute with the rights of another user called the proxy. The permission to perform the operation is still dependant upon the proxy user's rights to this attribute.

Write. The user has the right to change this attribute's value, remove the attribute, delete one or more values if it is multi-valued, create this attribute in the entry if it is not present, or add one or more values if it is multi-valued.

Write permissions are not always able to be determined effectively, in which case this column contains a question mark "?". This situation occurs when an ACI using the targattrfilters keyword applies to the given entry. In this case, access rights cannot be determined because they depend upon the value being added, which is unknown.

Virtual attributes do not have write permissions because they cannot be the target of modify, add or remove operations. The write and self-write permissions for a virtual attribute are replaced by the label "Virtual" in the table.

Self-Write Add. With this permission, the user may add their DN as another value of the attribute. This permission allows users to add themselves to group entries and other lists of DNs such as a mailing list.

Self-Write Delete. With this permission, the user may remove their DN if it is a value of the attribute. This permission allows users to remove themselves from group entries and other lists of DNs such as a mailing list.

The box below the table provides additional information about access rights shown in the table. Select a cell to view the additional information, which includes:

  • The name of the ACI, if any, that determines the access right.

  • Whether the access right was explicitly allowed or denied.

  • The overall write permission determined from a combination of write, self-write add, and self-write delete permissions.

Entry Level Tab

This tab displays the effective access rights of the chosen user for operations that involve the entire given entry.

Operation type. This column lists the types of access that are checked for permissions:

  • Add. The user would have the right to add the given entry if it did not already exist. This can be used as an indicator of the right to create other similar entries at a similar location in the directory. However, certain rights may be based on attribute values, and therefore creating an entry with different values may or may not be allowed.

  • Delete. The user has the right to delete the given entry.

  • Read. The user has the right to read the given entry, but not to override any read permissions denied at the attribute level.

  • Write. The user has the right to add, modify, or remove attributes according to the effective rights at the attribute level.

  • Proxy. The user has the right to read and write this entry with the rights of a proxy entry, but not to override any proxy rights denied at the attribute level. The permission to perform the operation is still dependant upon the proxy user's rights to this entry.

Has Rights? A check in this column indicates that the user has the right to perform the operation on that line. An empty checkbox indicates the user does not have the right.

Additional Information. This column provides information about the ACIs that allow or deny the given operation type.

See Also

"Viewing Effective Rights" in Chapter 6 of the Sun Java System Directory Server Administration Guide.


Contents      Dochome     
Copyright 2004 Sun Microsystems, Inc. All rights reserved.