Authorization

The topic provides information about the authorization strategy for the Virtual Directory users.

Administrative Users

The Virtual Directory users are different from users that are stored in the backend repositories. These users are administrative users whose information is stored in the configuration file and not in the backend repositories. The user definition includes user DN, password, and a role. The role decides the authority of the user to run LDAP operations. The following three roles are supported by Virtual Directory:

Administrator: Users with this role have an authority to add, modify, and delete users and read all attributes in the backend repositories.
Draft comment:
As per review meeting with Swikar, removed it. May 25,2016
They also have authority to update user passwords in backend repositories.
Writer: Users with this role have an authority to update and read all the attributes in the backend repositories.
Draft comment:
As per review meeting with Swikar, removed it. May 25,2016
These users also have authority to update user passwords in backend repositories.
Reader: This role enables users to read all the attributes in the backend repositories.

A sample configuration for Virtual Directory administrative users is shown here:

User stanza

dn: cn=FDProxyUser1, cn=Authorization, cn=FDProxy, cn=FDProxy Backends, cn=IBM Directory, cn=Schemas, cn=Configuration
cn: FDProxyUser1
ibm-slapdFDProxyAdminDN: cn=Admin1
ibm-slapdFDProxyAdminPW: {AES256}5BvFNgHwqAvWPJjJNs9KtA==
ibm-slapdFDProxyAdminRole: Administrator | Writer | Reader
objectClass: top
objectClass: ibm-slapdFDProxyAuthorization
objectClass: ibm-slapdConfigEntry

Backend Users

Information about backend users is stored in the backend repositories. Backend users can read and modify normal class attributes that are defined in the attribute mapping for their own entry. Backend users can modify only their own password.

Draft comment:
As per review meeting with Swikar, this was asked to remove. May 25, 2016

Draft comment:
If a bound user does not have any of these roles, that is, if a user from a configured backend repository binds to Virtual Directory, then they can update only their own password.

Backend users do not have authority to update, read, or delete critical and sensitive attributes. However, the userPassword attribute is an exception. Backend users can modify the userPassword attribute even if it is critical or sensitive.

Note: To modify the userPassword attribute, a user must have the required permissions at the backend server.