[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: More granular privileges in ACLs (Was: (ITS#3625) [enhancement] per-operation ACLs)

At 10:43 PM 4/2/2005, Pierangelo Masarati wrote:
>The patch is mainly intended as a fast prototyping of the feature, and to provide the ACL-side support (parsing & evaluation).  Now, to handle the SASL authz feature all we need is properly feed the realndn (currently c_ndn, but we can easily revert to o_realndn if there's other requirements about how to feed it). 

I suspect we're all agreeing.  I think your code is fine and
appears safe to commit.

Just to be sure, here is an identity mapping summary as it
relates to subject identities (the identity subject to access
controls).

When simple bind is used, the bind name is not only the
authcId and authzId, but these directly to the authcDN and
authzDN.  When SASL bind is used, the authcID and authzID
are not only possible different, but each is mapped to
produce the authcDN and authzDN.  When the proxy authorization
control, a new authzId is provided by the client, which through
mapping generates a new authzDN.  The real subject should be
the authcDN, the effective subject is the authzDN.

Kurt