Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition

Extending the Scope of a Role


ProcedureTo Extend the Scope of a Role



  1. Create a role for the user in the engineering subtree.

    For example, create the role EngineerManagedRole. This example uses a managed role, but it could just as well have been a filtered or nested role.


  3. Add the nsRoleScopeDN attribute to the SalesAppPlusEngNestedRole, with the DN of the engineering subtree scope that you want to add, in this case, o=eng,dc=example,dc=com.

    The necessary permissions must be granted to the engineering user so that he can access the SalesAppPlusEngNestedRole role and, in turn, the sales application. In addition, the entire scope of the role must be replicated.

    Note –

    The restriction of extended scope to nested roles means that an administrator who previously managed roles in one domain only has rights to use the roles that already exist in the other domain. The administrator is not able to create an arbitrary role in the other domain.