Add ACI for Administrators group if not already present

• Key: DIRSERVER-617
• Type: Task
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Alex Karasulu
• Reporter: Alex Karasulu
• Component/s: ldap
• Affects Version/s: 1.0-RC3, 1.0-RC2, 1.0-RC1, pre-1.0
• Fix Version/s: 1.5.0, 1.0-RC4

Description

Add ACI to enable Administrators group to have admin user like access to configure the server via the ou=system partition. This will only work when using the AuthorizationService for the X.500 basic authorization scheme as opposed to the DefaultAuthorizationService .

Comments

[Alex Karasulu]

Making sure this is also available on the 1.1 branch.

We might also want to hardcode into the DefaultAuthorizationService a lookup to check this group specifically to see if the user is in it. If so then they should have superuser access (full access).

[Ersin Er]

Note that a DACD can span a naming context at most. So an access control subentry subordinate to ou=system naming context cannot control access to other naming contexts.

[Ersin Er]

A mutable root partition is needed to be able to control all the DIT via subentries whose effective domain can span multiple partitions.

[Ersin Er]

I think we should have Administrators group for each partition and also for the whole system.

To have administrators for each partition we can create a container, ou=Administrators, with each partition created and we can arrange ACI accordingly that group for that partition.

To have system wide administrators there are two choices:
1. We will add some ACI to each creaed partition for ou=Administrators,ou=system group.
2. We will implement mutable RootDSE or hierarchical partitions in other words.

[Alex Karasulu]

Fixed in 1.0 branch:

  http://svn.apache.org/viewvc?view=rev&revision=439118

Fixed in 1.1 branch:

  http://svn.apache.org/viewvc?view=rev&revision=439119


Things were done a little differently here. I did not add an ACI but rather hardwired the Administrators group so this works with both the default authz service and the one that uses ACI. Basically all access control checks are bypassed for anyone in this very special admin group.