The BNF in section 6.1 defines rights as:
< rights > ::= [ ] | [ < right > + [ '$'
+ <right> ] * ]
This allows the rights part of the acl entry syntax to be empty and section 6.3 gives an example of an empty rights ACI:
aci: 1.2.3.4#subtree##group#cn=Dept XYZ, c=US
It goes on to say the interpretation of an empty rights ACI is server dependent. What is the purpose and/or value of allowing this type of ACI? If the interpretation of grant or deny is server dependent, it surely can't promote interoperability between ldap server vendors.
David
|
The BNF in section 6.1 defines rights as:
< rights > ::=
[ ] | [ < right > + [
'$'
+ <right> ] * ] This allows the rights part of the acl entry syntax to be empty and section
6.3 gives an example of an empty rights ACI:
aci: 1.2.3.4#subtree##group#cn=Dept XYZ, c=US
It goes on to say the interpretation of an empty rights ACI is server
dependent. What is the purpose and/or value of allowing this type of
ACI? If the interpretation of grant or deny is server dependent, it surely
can't promote interoperability between ldap server vendors.
David
|