The Access Control File Access Control Location

Managing the Embedded LDAP Server 9-5

9.5.1 The Access Control File

The access control file acls.prop maintained by the embedded LDAP server contains the complete list of access control lists ACLs for an entire LDAP directory. Each line in the access control file contains a single access control rule. An access control rule is made up of the following components: ■ Location in the LDAP directory where the rule applies. See Section 9.5.2, Access Control Location. ■ Scope within that location to which the rule applies. See Section 9.5.3, Access Control Scope. ■ Access rights either grant or deny. See Section 9.5.4, Access Rights. ■ Permissions either grant or deny. See Section 9.5.4.1, Attribute Permissions, and Section 9.5.4.2, Entry Permissions. ■ Attributes to which the rule applies. See Section 9.5.5, Attributes Types. ■ Subject being granted or denied access. See Section 9.5.6, Subject Types. Example 9–1 shows a sample access control file. Example 9–1 Sample acl.props File [root]|entrygrant:r,b,t[all]public ou=Employees,dc=octetstring,dc=com|subtreegrant:r,c[all]public: ou=Employees,dc=octetstring,dc=com|subtreegrant:b,t[entry]public: ou=Employees,dc=octetstring,dc=com|subtreedeny:r,cuserpasswordpublic: ou=Employees,dc=octetstring,dc=com|subtreegrant:ruserpasswordthis: ou=Employees,dc=octetstring,dc=com|subtreegrant:w,ouserpassword,title, description, postaladdress,telephonenumberthis: cn=schema|entrygrant:r[all]public:

9.5.2 Access Control Location

Each access control rule is applied to a given location in the LDAP directory. The location is normally a distinguished name DN but the special location [root] can be specified in the acls.prop file if the access control rule applies to the entire directory. If an entry being accessed or modified on the LDAP server does not equal or reside below the location of the access control rule, the given access control rule is not evaluated further. Note: The default behavior of the embedded LDAP server is to allow access only from the Administrator account in WebLogic Server. The WebLogic security providers use only the Administrator account to access the embedded LDAP server. If you are not planning to access the embedded LDAP server from an external LDAP browser or if you are planning only to use the Administrator account, you do not need to edit the acls.prop file and can ignore the information in this section. 9-6 Securing Oracle WebLogic Server

9.5.3 Access Control Scope