| Online Help
Sun Java System Directory Proxy Server 5 2004Q2

> Network Group Attributes View Search Tab
> Directory Proxy Server network groups describe how to identify an LDAP client, and the restrictions to enforce for clients that match that group. Clients are initially identified into a group based on the network address from which they connect. They may change their group after a successful bind.

> Network groups are tested in the descending order of priority, specified by their placement in the Network Group window. In this window, groups on the bottom of the list have less priority than those towards the top. If no groups are found to match a client, the client's request will be rejected. There must be at least one group entry in the configuration specification.

> Clients are identified to belong to this network group based on their IP address and/or domain name.

> This tab is used to prevent certain kinds of search and compare operations from reaching the LDAP server. If the client's request falls under this restriction, Directory Proxy Server will return an insufficient access error to the client.

> Group name. Enter the group name that specifies the name of the group. This value must be unique within the set of groups. This value must be present as it forms the RDN of entries of this class.

> Enable. By default, this option is selected for you. Deselect it to disable a group in a configuration. For a group to be part of Directory Proxy Server configuration, this option must be selected.

> Allow any attribute. By default, this option is enabled to permit all attributes to be used for search filters and comparisons.

> Forbid the following attributes. Enable this option to specify the name of an attribute or attributes that cannot be used by a client in a search filter or compare request.

> Only allow the following attributes. Enable this option to specify the name of an attribute or attributes that may be used in a search filter or compare request. If there is one or more attributes values present in a network group table and a compare does not match one of these, the request will be rejected by Directory Proxy Server. If there are no attributes present in a network group table, and an attribute does not match any attributes, then it may be used by clients. For example, if you want only the cn, dn, and mail attributes to be searchable by the client, add these attributes to the table.

> Add... Displays a dialog box that allows an attribute to be added to the table. You must specify above whether these attributes are to be forbidden or permitted.

> Edit... Displays a dialog box to edit a selected attribute in the table.

> Remove. Removes an attribute from the table.

> Copyright 2004 Sun Microsystems, Inc. All rights reserved.