How to set permissions IN Open Directory USING Open Directory groups?

Hi all,
Apologies if I've missed this but have been searching for two days trying to figure out how to delegate permissions within the OD to a number of different OD groups and i can't seem to find any way to do this either at the command line or with WGM.
Examples: an OD group containing those who will manage the full directory need to have permissions on all containers, child objects, and their attributes in the directory. For this one in particular I seem to be able to nest a group in the default Admin group, but this isn't really what i'm after. I need to create OD groups with the ability only to manipulate objects of class apple-computer and similarly, apple-user (really all inetOrgPerson objects). In a nutshell: how do i set permissions on specific attributes or object classes using OD groups?
thanks for any pointers...
-andrew

I think i just answered my own question: Open Directory is OpenLDAP. slapd is all i need.

Similar Messages

  • How to set which E-Mail gets used on a group

    I use groups to send specfic E-Mails to specific people. I have two diferent groups with the same people on it, but the E-Mail should be sent to diferent adresses (ex. Home, or Work).
    Since Lion, I can't define anymore in the Group "Home" which E-Mail address from a specific contact should be used...
    How do I do that?

    I have the same problem.  The Address Book Help clearly says to use the Edit>Edit Distribution List.
    However, that option is grayed out.
    Any ideas on why this would be and how to correct it?
    I have already tried turning off Contacts in iCloud in preferences and then waiting and turning it back on.  No change.

  • I cannot figure out how to set my apple id to use: itunes (two of accounts), apps store and Itunes store. How do I make one password that will be recognixed by all these devices?

    I cannot figure out how to set my apple id to use: itunes (two of accounts), apps store and itunes store. How do I make one password that will be recognized by all these devices? My apple id is constantly not working.

    Hi Lrwill,
    If the apps that are on your son's iPad were purchased under his Dad's Apple ID, then signing your Apple ID onto the iPad will not help you with updating those apps.
    Also, if the iPad was sync'd with his Dad's iTunes library, then hooking it up to your computer/iTunes library, will require you to reset the iPad, and everything that was loaded under the other Library and Apple ID will be wiped out.
    Can you provide a little more info about what was set up under which Apple ID and what iTunes library the iPad was sync'd with?
    Cheers,
    GB

  • How to set Border in the Excel using UTL_FILE ?

    Hi all,
    Any one aware of
    How to set Border in the Excel using UTL_FILE ?
    Am doing excel creation from a stored procedure.
    Thanks
    Dora

    Hello Dora,
    if you need more than simple csv: at Re: How to save a query result and export it to, say excell? you can find links to different solutions. At least the package behind the second link supports defining your own formats (and has a tutorial how to do it).
    Regards
    Marcus

  • How to set the full screen mode using setClip method

    hi all,
    how to set the full screen mode using setClip in that softkeys should not be used insteat on that need to create a own softkeys using commands.
    thanks & regards
    Bala.

    In CS5 there are changes made to how the screen mode is reported. In CS3-CS5 the screen mode has a corresponding number. So for instance if the ScreenMode is set to "Preview Off" and you ask indesign CS3 or CS4 to display the screen mode, it will report "1936552047", while in CS5 it will report "PREVIEW_OFF".
    try executing this simple command in respectively CS3, CS4 and CS5 and you will see what I am talking about:
    alert(app.activeWindow.screenMode);
    there is no difference if you do:
    alert(app.activeDocument.layoutWindows[0].screenMode);
    The CS5 solution is rather awkward to work with, unless I am missing something? PREVIEW_OFF is not a string, nor is it a number.
    Example -  doing:
    myScreenMode=app.activeDocument.layoutWindows[0].screenMode;
    and then trying to reset screenMode by something like:
    app.activeDocument.layoutWindows[0].screenMode= myScreenMode
    does not work in CS5 of course. It will throw an error. Neither will this line work:
    app.activeDocument.layoutWindows[0].screenMode=ScreenModeOptions.myScreenMode;
    Any way of working around this?

  • How to Set "DateOnly" property in DateTimeControl using Javascript.

    How to Set "DateOnly" property in DateTimeControl using JavaScript.

    Is there any specific reason you want to set it through JavaScript ? You can directly set the DateOnly property in the markup itself.
    <SharePoint:DateTimeControl runat=server id="dtControl" DateOnly="true"></SharePoint:DateTimeControl>
    Please can you elaborate on what exactly is the requirement for setting this through javascript?
    Geetanjali Arora | My blogs |

  • I don't know how to set up closingFirefox to have all open tabs next time when I open it, without calling RESTORE PREVIOUS SESSION

    Question
    I don't know how to set up closingFirefox to have all open tabs next time when I open it, without calling RESTORE PREVIOUS SESSION

    Tools > Options > General
    :At the top '''When Firefox starts:''' Show my windows and tabs from last time
    You can still bring up your home page later.

  • How to set permissions on a file for a Mac without active Directory

    We don't have our Macs in the Active Directory, we are looking to share an external hard drive to only Macs and not the Windows PC's on the network with out using active directory. I have tested sharing the external hard drive from a PC to everyone and both the PC's and Macs can access this, but we only want the Macs to see this and access this and not everyone. There is no selection for sharing with the computer name in the Share permissions so the only way to do this is to share it to everyone. The Mac accounts are local to the Macs and the PC's are on Active Directory so what i need to do is have a way to share this folder with only Macs and not all the windows PC's. Any solutions, any ideas will help
    Thanks

    hi
    good
    go through these links
    http://help.sap.com/saphelp_nw2004s/helpdata/en/b9/b4de3f68d48f15e10000000a155106/content.htm
    http://help.sap.com/saphelp_nw04s/helpdata/en/be/0de03f41b9eb06e10000000a1550b0/content.htm
    thanks
    mrutyun

  • How to set permissions like "For all users" with Sandbox

    Hello!
    Hello!
    I am using Sandbox for Mac OS X Leopard and I've got a question to you:
    How can I set up a folder to behave like the For all users folder in the users directory?
    Greetings

    Well, sandbox sets ACL's not posix permissions. The sticky bit is a posix permission. Sand box will allow you to do something similar to the sticky bit using ACL's, but the exact duplication of the sticky bit is not possible, but something just as useful or more useful can be easily implemented.
    To set the sticky bit you will need an app called FileXaminer or the Terminal.app command line.
    to set the sticky bit simply put "1" in front of the the permissions number when you run chmod on the command line, here is an example:
    chmod 1775 /users/data/shared #assigns permissions 775 and the sticky bit#
    chmod 775 /users/data/shared #assigns permissions 775 without the sticky bit#
    note: note actual use of the chmod and chown commands will, in most cases require the sudo (super user do) command to be used with them. example:
    sudo chmod 1775 /users/data/shared #assigns temporary super user priviledge#
    The way I set my shared user's directories with ACL's is this:
    first I created folder /users/data -permissions=777 (everyone).
    I had three users so I created folders for each in /users/data:
    /users/data/user1 #this is just example-substitute real user name#
    /users/data/user2
    /users/data/user3 #etc,etc,#
    set the posix permission on each user folder 700 (owner:read,write,execute)
    set the owner and group on each one accordingly:
    chown user1:staff /users/data/user1 #substitute real user name#
    chown user2:staff /users/data/user2
    chown user3:staff /users/data/user3 #(etc,etc)#
    Now each user has their own data folder they can read and write to at will (when they are logged in to their user account).
    They can safely create and maintain their data and no one can delete it.
    Since these are shared data accounts. other users will need to read the data, this is where the ACL's come in.
    You will need to use Sandbox to place ACL's for each allowed user, on each of the user directories:
    0: user:joe inherited allow list,addfile,search,add_subdirectory,readattr,writeattr,readextattr,writeextattr,readsec urity,file_inherit,directoryinherit
    1: user:mary inherited allow list,addfile,search,add_subdirectory,readattr,writeattr,readextattr,writeextattr,readsec urity,file_inherit,directoryinherit
    2: user:sue inherited allow list,addfile,search,add_subdirectory,readattr,writeattr,readextattr,writeextattr,readsec urity,file_inherit,directoryinherit
    Basically with the above ACL's the only thing the allowed user can't do is delete files. They can copy files, they can add files, etc. This behavior is somewhat similar to what can be accomplished with the sticky bit, but much more controlled and structured. That is the beauty of using ACL's.
    Using SandBox you can taylor the permissions as you see fit for each every user. You can set permissions for an administrator to delete files as well. You can take away or add permissions for each user as you see fit. let your imagination be your guide.
    ACL's weren't meant to replace posix permissions, but rather to allow administrators to fine tune user permissions.
    Kj

  • How to set MQ message header properties using JMS adapter? (10.1.2)

    Hello,
    I am trying to send MQ messages from a BPEL process. We are using OAS 10.1.2 and JMS MQ adapter. Could you please let me know how to set the message descriptors like message format, type, report and reply to queue properties and queue open options (in jmsAdapterOutboundHeader).
    Regards,
    Geratayya

    put something like this
    <activationAgents>
          <activationAgent className="oracle.tip.adapter.fw.agent.jca.JCAActivationAgent" partnerLink="PARNERLINKNAME">
            <property name="clusterGroupId">SOMEUNIQUEVALUE</property>
            <property name="portType">PARTNERLINK_PORTTYPE</property>
          </activationAgent>
        </activationAgents>

  • How to set permissions on devicemapper block device

    I'm setting up a new RAC on RHEL5.1 using device mapper for multipath functionality.
    How should I set the permissions for the block devices I'm going to use for ocr, voting and asm?
    /dev/mapper/ocr1
    /dev/mapper/voting1
    etc.
    Regards
    Jon-Arne Storelv

    Markus,
    You are right about udev changing drastically between RHEL 4 and RHEL 5. The paper I referred to does include some guidelines for setting permissions for RHEL 5 as well. Here are some relevant extracts from the same pdf document:-
    # From udev.permissions section
    This file was obsoleted in later versions of the 2.6 kernels such as SLES10, RHEL5 and
    Oracle Enterprise Linux 5 (OEL5), that functionality was merged into the rules files, which is explained later in this paper
    ...and later you will find this example in the document
    For RHEL5, OEL5, SLES10
    • Create a file /etc/udev/rules.d/99-raw.rules with the following content
    with the following content
    KERNEL=="raw[1-2]*", GROUP="oinstall", MODE="640"
    KERNEL=="raw[3-5]*", OWNER="oracle", GROUP="oinstall", MODE="660"
    /etc/udev/rules.d/50-udev.rules on Centos 5 gives plenty of examples of settings for all different types of devices. We really need to specify OWNER, GROUP and MODE for devices that RAC will use in a rules file.
    Thanks,
    Satish

  • How to set permissions to allow reading on more than one device

    Our base permissions restrict reading to one device for 365 days with print 1 page and copy 1 page limits. For a new book we're adding to our online library, we want to allow people to read on more than one device, with a defined expiration date (January 15, 2012) and no printing and no copying. (The "more than one device" restriction is intended to allow users to transfer the book to iTunes and read it in Bluefire Reader.)
    How do we set permissions for this new book? In particular, what Read settings for devices do we use? No selection? The options in the ACS Console are not clear to us (i.e., the choice between A Single Device and Specific Device Type) and the manual doesn't offer an example. ... I'm guessing the selections should be none -- i.e., do not specify any device setting. Yes?
    Any help would be appreciated.
    Jim Lyons

    What I understand your current side restrictions to be (best if they are in a distribution right rather than base permission btw)
    <permissions>
    <display>
         <device />
         <duration>31536000</duration>
    <display>
    <print>
      <count initial="1"/>
    </print>
    <excerpt>
        <count initial="1"/>
    </excerpt>
    </permissions>
    What I think you want
    <permissions>
    <display>
         <device />
         <duration>31536000</duration>
    </display>
    <display>
         <deviceType>mobile</deviceType>
         <until>2012-01-15T00:00:00-8:00</until>
    </display>
    <display>
         <deviceType>tethered</deviceType>
         <until>2012-01-15T00:00:00-8:00</until>
    </display>
    <print>
      <count initial="1"/>
    </print>
    <excerpt>
        <count initial="1"/>
    </excerpt>
    </permissions>
    (these are looking at the raw permissions rather than the dialog in the admin console)
    Which I would describe as allow viewing on the device which fulfilled the content for one year, and in addition allow viewing on any mobile or tethered device (Bluefire Reader iPad app, android app, Nook Color, etc...) until Jan 15, 2010 at midnight PST.  One print and one copy is allowed (and can only be used on the device that fulfilled the content).

  • How to set permissions for folder?

    Dear all,
    How can iset permissions for a particular folder?
    I am creating new folders for new users  who access the program. 
    Is there any way yo set permissions so that no one is able to edit the name of the folder ?
    Thanks,
    Ritesh

    Hi Ritesh,
    Thanks for the post and I hope your well today.
    You can programmatically change the Read Only and Hidden Status of a file
    in labview using the DOS prompt from LabVIEW - called
    System.Execvi.
    Here are some links regarding the DOS commands you can use,
    http://www.ss64.com/nt/subinacl.html
    http://www.ss64.com/nt/cacls.html 
    So I beleive you could find a DOS command which could alter the editting properties of the name..
    Another way to prevent the user altering the file would be to change
    the user permission's in windows.. but it could affected the code and
    most IT departments would not allow this.
    Hope this helps,
    Kind Regards
    James Hillman
    Applications Engineer 2008 to 2009 National Instruments UK & Ireland
    Loughborough University UK - 2006 to 2011
    Remember Kudos those who help!

  • How To Set Up Airport Express To Use With iPad2 For My Needs ?

    On the advice of several people in a audio forum, I just purchase an Apple Airport Express. I will be using it with my new iPad 2. What I need to accomplish is using my iPad2 to stream subscription based music from the internet to the Airport Express, and for the Airport Express to connect via toslink cable to the DAC in my audio system.
    What I am not sure about is how to set up my Airport Express to accomplish this. I do have a wireless network in my home, but wish to keep the wireless connectivity between the Airport Express and the iPad2 separate from it.
    I would greatly appreciate any assistance with this. Thanks.

    Deggie, firstly, thank you for your attempt to help. I greatly appreciate it. I connected it via the ethernet cable to the router since when I reconfigured the Airport Express adding it to my existing wireless system, the iPad could not connect to anything until I unplugged the Airport Express. I set it up for an ethernet connection to my router based on that experience.
    Either the Ipad does not seem able to send anything to the Airport Express, or the AEX is not passing anything on. I also tried streaming a song stored on the iPad 2 to the AEX with no result, so it is not an issue with the subscription channel.
    I don't own a miniplug cable of any sort for further testing, but the toslink cable is brand new, and was literally taken out of its package and plugged in, so I feel it extremely unlikely it is the issue. I've also tested it in three inputs on the DAC, so it is definitely not an issue with it.
    I have a question though. You said "when you start your subscription and go to Airplay, does the iPad see the AEX?" You may be on to something there. How do I "go to Airplay" I thought it was just automatic?  Also, how do I "select it"? This may be the problem.

  • How to set tabstops in MS Word using the LabVIEW Report Generation Toolkit

    Using the Report Generation Toolkit of LabVIEW, I need to set multiple tabstops that very in distance in MS Word.  I also have different sets of tabstops that I use and re-use at different times in the same report.  Is there a way to set the tabstops under program control?  I searched through the various VIs and found that there is a property ("Tabstops", "Word.Tabstops") in the _ParagraphFormat property node that refers to tabstops.  I found it in the Word Format Paragraph (adv) VI.  Unfortunately, I could not determine how to use it.  Any suggestions?  Is this an operational element?

    Bluebell,
    Sounds like you've already done some fantastic work to expose the various properties and methods of MS Word. It took me about 20 min before I could find the specific property that you were talking about! I found it under Word.Document>>Paragraphs>>Tabstops>>Add. There is a position, alignment and leader parameter that you can set from this property node. I've found that the best way to discover what these parameters do is to simply experiment. You could also try using the macro recorder in Word, perform the specific task, and then look at the code generated. I'm guessing that position sets the position of the tabstop itself. It sounds like your application is really specific. For such a specific task, I think I'd write a macro and call that macro from LabVIEW.
    Chris Cilino
    National Instruments
    LabVIEW Product Marketing Manager
    Certified LabVIEW Architect

Maybe you are looking for