Default ES Security Configuration

Add Allow unknown resources Allow unknown users Cache limit: Cache TTL: Configuration information Create audit events Default ES Security Manager List Description | Enabled Module Name Priority Remove Select Use all groups Verify against all Security Managers

Default ES Security Configuration

  Use this page to define default security settings that can be used with Directory Server and enterprise servers. You can override these defaults for individual servers.

  Top

Verify against all Security Managers

  Set this if you want each security query to be checked by all entries on the Security Manager Priority List.

  If this is not set, the entries will be queried in the order that they appear on the Priority List until one gives a response of Allow, Deny, or Fail (equivalent to Deny). This response will then be used to decide what action should be taken.

  If this field is set, all entries on the list will be queried, and if any returns a Deny or Fail, the access request will be denied. If there are no Deny or Fail responses and at least one of the entries on the list gives Allow as its response, the request will be allowed.

  If a security manager does not have a rule for the resource or user specified in the request, it gives a response of Unknown. Whatever the setting of the Verify against all Security Managers field, if all of the entries on the priority list respond with Unknown, the request will be denied unless you have checked Allow unknown resources or Allow unknown users.

  Top

Allow unknown resources

  Check this if you want the security facility to permit access to any unknown resource; that is, any resource for which all entries on the priority list return Unknown.

  You might use this in circumstances where you only want to restrict access to some resources.

  Top

Allow unknown users

  Check this if you want to allow unknown users to log in.

  Top

Use all groups

  Check this if a user requesting authorization is to have the permissions of every group to which he or she belongs.

  Uncheck this if the user is to have only the permissions of the group specified in the initial security API call that requested verification (authentication) of the user's credentials. Where no group is specified in the verify call, a default group is used.

  Top

Cache limit:

  Enter the maximum size in kilobytes that the Directory Server or enterprise server's security facility can use for caching the results of security queries.

  Top

Cache TTL:

  Enter the maximum time in seconds that an entry in the cache can be used to satisfy requests before the details must be requeried from the security manager.

  Top

Create audit events

  Check this to enable the enterprise server or Directory Server to generate security audit events. These events can be captured and logged by the Audit Facility.

  Top

Configuration information

  Specify any additional configuration settings that the security facility requires.

  Top

Default ES Security Manager List

  This is the list of security managers (taken from the available pool) that can be used to perform security queries.

  Note: Security managers are queried in the order that they appear in the list. If the Verify against all Security Managers checkbox is not checked, the first manager in the list that responds with a definite answer will determine the result of a security query. See the text for Verify against all Security Managers for more details.

  Use the up and down arrows to reposition the selected entry.

  Top

Select

  Use this to select a security manager for removal or for moving to a different position in the list.

  Top

Name

  This column shows the name that used to identify a security manager.

  Top

Priority

  Indicates the position of the security manager in the sequence in which the security managers are queried.

  Top

Module

  This column shows the module used by a security manager to access an external security manager or to implement the security rules.

  Top

Description

  The description column shows the description for a security manager.

  Top

Enabled

  This column indicates whether or not the security manager is enabled. If it is not enabled, it will be ignored by Directory Server and those enterprise servers that reference it.

  Top

Add

  Click this to add a security manager from the pool of available definitions.

  Top

Remove

  Click this to remove the currently selected definition from this list.

  Note: The definition is only removed from this list, not from the available pool of definitions.

  Top