search right in draft-ietf-ldapext-acl-model-04.txt

[David Ward <dsward@novell.com>]

Section 6.2.1.1 describes attribute rights ( read / write / search / compare ) and entry rights ( add / delete / editDN ).  In my opionion, the "search" right should be applied at the entry level not the attribute level.  I would argue that you search an object and possibly its subordinate objects,  and objects that match the search criteria are returned.  This makes it easy to grant or deny searching in portions of the directory.  

When applied at the attribute level, are you granting or denying the search operation?  I would argue no.  You are only restricting the attributes that can be used in the search filter.  I guess you could prevent the search operation by denying search for all attributes.  

I think the compare right effectively does the same thing as the attribute level search right.  By denying compare on an attribute, would not the equivalence check fail during the search operation.  The user does not have the rights to compare it.

David