## Create/Edit ACL

The Access Control Rules page allows you to specify parameters for a new access control list (ACL) file or edit an existing ACL.

The following table describes the fields and buttons on the page. The left column lists the fields and buttons; the right column describes the functionality.

Field or Button | Description
--- | ---
ID | Specifies the ID of the ACL.
File: | ACL files are text files that contain lists that define who can access resources stored on Sun ONE Application Server. By default, the Sun ONE Application Server uses a single ACL file that contains all the lists for accessing your server. As an alternative to this default, you can create multiple ACL files and reference them in the obj.conf file.
Edit ACL file | Click this button to go to the Access Control List Management page. To edit the rules for a selected ACL, you then click the Edit Access Control button on the Access Control List Management page. The ACL Rules table is displayed.
Action | Specifies the action the server takes when a request matches the access control rule. Allow: Allows the user, group, or host access. Deny: Denies the user, group, or host access. Update: Saves your entries. Reset: Resets the values on the page to the default values.
User/Group | Specifies who will be required to provide user name and password before accessing the resource specified in the access control rule.
| Anyone: Allows access to everyone; no authentication is required.
| Authenticated people only: Allows access only to authenticated people. Choices are: All in the Authentication Database: Allows all users and groups in the LDAP directory. Only the Following People: Allows only the specified user and groups.
| Prompt for Authentication: Allows you to specify message text that appears in the authentication dialog box. Depending on the operating system, the user sees about the first 40 characters of the prompt. Netscape Navigator and Netscape Communicator cache the user name and password and associate them with the prompt text. This means that if the user accesses directories and files of the server that have the same prompt, the user will not have to retype user names and passwords. If you want to force users to reauthenticate for various areas, you much change the prompt for the ACL on that resource.
| Authentication Methods: Specifies the method the server uses when getting authentication information about a client. Options: Default: Uses the default method you specify in the `obj.conf` file; Basic is used if there is no `obj.conf` setting. If you check Default, no method is specified in the ACL file. Default is the preferred choice because it allows you to change the methods for all ACLs by editing one line in the `obj.conf` file. Basic: Uses the HTTP method to get authentication information from the client. User name and password are only encrypted if encryption is enabled for the server. Digest: Uses the user name and password without sending the user name and password as clear text. Digest value is computed on the server side (using the digest authentication plugin) and compared against client digest value. SSL: Uses the client certificate to authenticate the user, if SSL is enabled for the server. If encryption is also enabled, you can combine Basic and SSL methods. Other: Uses a custom method you create using the access control API.
From Host | Specifies hosts that are allowed to access the resource. Anyplace: Allows any machine to access the resource. Only from: Allows only the specified host names or IP addresses to access the resource. Specify this restriction by using wildcard patterns that match the machines' host names or IP addresses.
Rights | Specifies the type of access rights that are allowed for the resource. All Access Rights: Allows the user, group, or host all access rights. Only the Following Rights: Allows only the selected access writes. Options: Read: User can view a file. Includes the HTTP methods GET, HEAD, POST, and INDEX. Write: User can change or delete a file. Includes the MTTP methods PUT, DELETE, MKDIR, RMDIR, and MOVE. Execute: User can run server-side applications such as CGI programs and Java applets. Delete: User who also has write privileges can delete a file or directory. List: User can get directory information. Info: User can get headers (`http_head` method).
Extra | Specifies a customized ACL entry; applied when you use the access control API to customize ACLs.
Continue | Specifies that the next line in the access control rule chain is evaluated before the server determines if the user is allowed access.
| When creating multiple lines in an ACL entry, it's best to work from the most general restrictions to the most specific ones.
Access Control Is On | Specifies if access control is set. Default is checked.
New LIne | Adds another line in the rules table.
Response When Denied | Specifies the message to display when access is denied. You can create a different message for each access control object. Default message is: "FORBIDDEN. Your client is not allowed access to the restricted object." Respond with the Default File (Redirection Off): Uses the message in the default file. Respond with the Following URL (Redirection On): Redirects to this URL. Update: Saves your entries. Reset: Resets the values on the page to the default values.
Submit | Saves your entries in the rules table.
Revert | Resets the values on the page to the default values.

See also
| Manage ACLs View ACLs

Legal Notices