“Create an LDAP access control diagram with Directory Administrators assigned full administration, a Help Desk Group assigned a password-reset role, and that role delegated to the People organizational unit.”
図の背後にある意思決定を読み解く。
Start with the teams that need access.
Map group membership to directory roles.
Identify the directory or OU each role controls.
Limit help desk rights to the needed action.
Use it for access-review conversations and align the labels with the directory product's actual group and ACL configuration.
よくある質問
Why show groups separately from roles?
Groups identify people who receive access; roles identify the permissions or administrative function those people are assigned.
What is delegated administration?
It is the practice of granting a limited set of directory-management actions to a group without giving it full directory control.
How does this support least privilege?
It makes the scope of each role visible so a help desk group can be limited to the specific organizational unit and action it needs.