Re: ACIs rely on multivalue attribute order (Was: are mulivalued attributes really unordered?)

["Pierangelo Masarati" <ando@sys-net.it>]

> On a related note, I see that the current implementation of ACIs relies on
> the ordering of multivalued attributes; in fact, ACI values are evalated
> in the order they appear, and as soon as one matches, the checking
> terminates.; of course, writing ACIs with different values of the
> OpenLDAPaci attributes that overlap whould be considered wrong, but in any
> case it is possible and I guess in some cases it may also be considered
> desirable (I didn't consider this enough to exclude that possibility).

I overlooked the design; the above is only partially true, in the sense
that all rules (i.e. all values) are evaluated for a single object; what I
haven't understood yet is if the order in which they are evaluated is
irrelevant or may alter the resulting permissions.

p.

-- 
Pierangelo Masarati
mailto:pierangelo.masarati@sys-net.it


    SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497