Legacy Directory Server Security Model

This topic describes the legacy security model for controlling access to the features of a Micro Focus Directory Server and Enterprise Server Administration. This security model is supported with the Enterprise Server External Security Facility through the MFDS Internal Security Manager.

Overview

The ability to view, and to alter, objects and schema settings within Directory Server is controlled through a system of user accounts, user groups and permissions.

Each user wanting to use the administrative features must log on. The features available to the user are controlled by permissions. You grant permissions to a user group. The users within that group can then perform the actions governed by those permissions.

Application access and Administration Access

When Directory Server is using the MFDS Internal Security Manager, any enterprise server that connects to the Directory Server to obtain or modify configuration information must supply valid user credentials. If, in addition, you have set the Restrict administration access configuration option, any user wanting to use the administrative features must provide credentials to log on. The features available to the user or application are controlled by permissions. You grant permissions to a user group. The users within that group can then perform the actions governed by those permissions.

Understanding Users and Groups

When you connect to Enterprise Server Administration for a Directory Server that is running in restricted mode, you are presented with a summary screen. This screen shows basic details of the enterprise servers managed by the Directory Server.

Before you can perform any other actions, you must log on. To do this you require a user account. Directory Server comes with a number of preconfigured user accounts but you can create others.

When you have logged on, the features that you can use depend on the permissions granted to the user groups of which your user is a member.

Each user can be in many user groups. Again, Directory Server has several preconfigured groups and you can create others. Each of the preconfigured groups has appropriate permissions for a particular administrative task. One or more of the supplied users are assigned to each of the groups, with the exception of the System group, which is used by Micro Focus applications.

Group Description Preconfigured users assigned
All Users This is the most limited group. Its default Enterprise Server permissions are set as Read only. This permission enables a user in the group to view configuration information for enterprise servers. All users are included in this group. schemaadmin, adddelete, modify, administrator
Add/Delete This group has default Enterprise Server permissions that enable:
  • the addition and deletion of servers
  • the addition and deletion of services, listeners and packages to servers
adddelete, administrator
General Administrators This group has default enterprise server permissions that enable all administration activities for enterprise servers. It also has permissions allowing all Directory Server administration activities with the exception of user managements. administrator
Directory Server Administrators This group has full permissions for the administration of the Directory Server and all enterprise servers. schemaadmin
Modify This group has default enterprise server permissions that enable the modification of enterprise server configuration information. modify
System This group is for the use of Micro Focus applications.

Understanding Permissions

A permission controls use of a feature of Directory Server. For example, there is a permission that governs the administration of users and groups. You grant permissions to user groups.

There are two categories of permissions:

Directory Server Administration These govern the administration of the Directory Server repository (for example, the management of user accounts).
Server These govern the administration of the enterprise servers that are controlled by the Directory Server.

Some permissions include others. For example, the permission to modify an enterprise server includes the permission to start and stop the server. When a permission is granted, all those that it includes are automatically granted.

Directory Server Permissions

The following table describes the available Directory Server permissions.

Name Description
Save Repository Permits saving a copy of the repository to a file system directory.
Import Repository Permits importing data from a file system directory.

Includes the following permissions: Save Repository.

Restore Repository Permits restoring a repository from a file system directory. The process of restoring overwrites all of the information in the current repository.

Includes the following permissions: Save Repository, Import Repository.

Delete Repository Permits deletion of the entire Directory Server repository including all enterprise servers, and all users and groups.

Includes the following permissions: Save Repository, Import Repository.

Change MF Directory Server options Permits changing of Directory Server options.

Includes the following permissions: Save Repository, Import Repository.

Set Server Permissions Permits the allocation of permissions on individual enterprise servers.

Includes the following permissions: Save Repository, Import Repository, Restore Repository, Delete Repository, Change MF Directory Server.

Display Directories Permits the viewing of a list of the Directory Servers that your Directory Server can detect on the network.

Includes the following permissions: Save Repository, Import Repository, Restore Repository, Delete Repository, Change MF Directory Server, Set Server Permissions.

Shutdown MF Directory Server Permits the shutting down of the Directory Server.

Includes the following permissions: Save Repository, Import Repository, Restore Repository, Delete Repository, Change MF Directory Server, Set Server Permissions.

Administer Users Permits the management of user accounts and user groups, and the setting of permissions.

Includes the following permissions: Save Repository, Import Repository, Restore Repository, Delete Repository, Change MF Directory Server, Set Server Permissions, Display Directories, Shutdown MF Directory Server.

Server Permissions

The following table describes the available server permissions.

Name Description
Read Permits viewing of an enterprise server configuration information.
Start/Stop Permits the starting and stopping of an enterprise server.

Includes the following permissions: Read

Modify Permits the modification of configuration information for an enterprise server.

Includes the following permissions: Read, Start/Stop

Add Permits the adding of listeners, services and packages to an enterprise server. When set as a default permission for the group, it also permits the adding of enterprise servers.

Includes the following permissions: Read, Start/Stop, Modify

Delete Permits the deletion of enterprise servers, and of listeners, services and packages from an enterprise server.

Includes the following permissions: Read, Start/Stop, Modify

You can set default server permissions for a group, but you can also override these defaults for individual enterprise servers. For example, you might have an operator group with default permissions to start and stop servers. You could override these for your test server, specifying that the operator group also has modify permission.

Note: To permit a group to create new servers, you must set its default Add permission.

Managing Users and Groups

You use screens within Enterprise Server Administration to manage users and user groups. To do this, you must be logged on to a user account that is a member of a group with appropriate permissions. The preconfigured user, schemaadmin is suitable for this task.

How to...

Setting Permissions

You set the permissions for each group using screens within Enterprise Server Administration. To do this, you must be logged on to a user account that is a member of a group with appropriate permissions. The preconfigured user, schemaadmin is suitable for this task.

How to...

Best Practice

Change the passwords of the preconfigured accounts at the earliest possible opportunity.

Ensure that only those users who need access have user accounts.

Ensure that users have only the permissions that they require in order to do their jobs.

Limit the number of administrative users.

Migrating from a Previous Version

In previous versions of Directory Server, user activities were controlled by assigning each user to one of four possible permission levels. These were: Modify, Add/Delete, Administrator, Schema Administrator.

When you upgrade to 5.0, your Directory Server user accounts are automatically migrated to the new groups and permissions model. Each user is assigned to a default group possessing permissions equivalent to its permission level.

Permission level Equivalent Group
Modify Modify
Add/Delete Add/Delete
Administrator General Administrator
Schema Administrator Directory Administrator

Consequently, your users should continue to have the ability to access and use Enterprise Server Administration in the same way as before.

In previous releases, user information was stored in the CCIUSERS.dat file. It is possible, using the Import Users function of Enterprise Server Administration, to manually import users from the CCIUSERS.dat file of another Micro Focus Directory Server installation running on the previous version. To do this, you must be running your Directory Server in unrestricted mode.