Edit ACL Rules

The Access Control Rules page allows you to modify or add rules for the selected ACL file.

The following table describes the fields and buttons on the page. The left column lists the fields and buttons; the right column describes the functionality.

Field or Button
Description

Action

Specifies the action the server takes when a request matches the access control rule.

Allow: Allows the user, group, or host access.

Deny: Denies the user, group, or host access.

Update: Saves your entries.

Reset: Resets the values on the page to the default values.

User/Group

Specifies who will be required to provide user name and password before accessing the resource specified in the access control rule.


Anyone: Allows access to everyone; no authentication is required.


Authenticated people only: Allows access only to authenticated people. Choices are:

  • All in the Authentication Database: Allows all users and groups in the LDAP directory.

  • Only the Following People: Allows only the specified user and groups.


Prompt for Authentication: Allows you to specify message text that appears in the authentication dialog box. Depending on the operating system, the user sees about the first 40 characters of the prompt. Netscape Navigator and Netscape Communicator cache the user name and password and associate them with the prompt text. This means that if the user accesses directories and files of the server that have the same prompt, the user will not have to retype user names and passwords.

If you want to force users to reauthenticate for various areas, you much change the prompt for the ACL on that resource.


Authentication Methods: Specifies the method the server uses when getting authentication information about a client. Options:

  • Default: Uses the default method you specify in the obj.conf file; Basic is used if there is no obj.conf setting. If you check Default, no method is specified in the ACL file. Default is the preferred choice because it allows you to change the methods for all ACLs by editing one line in the obj.conf file.

  • Basic: Uses the HTTP method to get authentication information from the client. User name and password are only encrypted if encryption is enabled for the server.

  • Digest: Uses the user name and password without sending the user name and password as clear text. Digest value is computed on the server side (using the digest authentication plugin) and compared against client digest value.

  • SSL: Uses the client certificate to authenticate the user, if SSL is enabled for the server. If encryption is also enabled, you can combine Basic and SSL methods.

  • Other: Uses a custom method you create using the access control API.

From Host

Specifies hosts that are allowed to access the resource.

Anyplace: Allows any machine to access the resource.

Only from: Allows only the specified host names or IP addresses to access the resource. Specify this restriction by using wildcard patterns that match the machines' host names or IP addresses.

Rights

Specifies the type of access rights that are allowed for the resource.

All Access Rights: Allows the user, group, or host all access rights.

Only the Following Rights: Allows only the selected access writes. Options:

  • Read: User can view a file. Includes the HTTP methods GET, HEAD, POST, and INDEX.

  • Write: User can change or delete a file. Includes the MTTP methods PUT, DELETE, MKDIR, RMDIR, and MOVE.

  • Execute: User can run server-side applications such as CGI programs and Java applets.

  • Delete: User who also has write privileges can delete a file or directory.

  • List: User can get directory information.

  • Info: User can get headers (http_head method).

Extra

Specifies a customized ACL entry; applied when you use the access control API to customize ACLs.

Continue

Specifies that the next line in the access control rule chain is evaluated before the server determines if the user is allowed access.
tip When creating multiple lines in an ACL entry, it's best to work from the most general restrictions to the most specific ones.

Access Control Is On

Specifies if access control is set. Default is checked.

New LIne

Adds another line in the rules table.

Response When Denied

Specifies the message to display when access is denied. You can create a different message for each access control object. Default message is: "FORBIDDEN. Your client is not allowed access to the restricted object."

Respond with the Default File (Redirection Off): Uses the message in the default file.

Respond with the Following URL (Redirection On): Redirects to this URL.

Update: Saves your entries.

Reset: Resets the values on the page to the default values.

Submit

Saves your entries in the rules table.

Revert

Resets the values on the page to the default values.

See also

Manage ACLs

View ACLs


Legal Notices
Copyright © 2004 Sun Microsystems, Inc. All rights reserved. Use is subject to license terms.