Re: vendorACI attribute in draft-ietf-ldapext-acl-model-04.txt

[Mark Smith <mcs@netscape.com>]

No, I don't think we should specify the attribute type for access
control information at all (except for the LDAPv3 scheme).  In other
words, the aCIMechanism should just specify the OID for a scheme and
clients and servers that have knowledge of a particular scheme will just
need to know what attribute type is used for storing the access control
information.  I just don't think we can mandate use of a particular type
like vendorACI.  Some schemes may use more than one attribute type.  And
so on.

-- 
Mark Smith
iPlanet Directory Architect / Sun-Netscape Alliance
My words are my own, not my employer's.   Got LDAP?



Ellen Stokes wrote:
> 
> Mark,
> Currently, aCIMechanism is just a list of OIDs of access control mechanisms
> supported in a given naming context. Are you proposing that we extend this
> format to say a structured LDAPstring to indicate not only the mechanism but
> the attibutes associated with that mechanism?
> Ellen
> 
> At 09:09 AM 10/15/1999 -0400, Mark Smith wrote:
> >Ellen Stokes wrote:
> >>
> >> David,
> >> The intent of vendorACI is to provide a way in which to allow non-LDAP
> >> defined ACI to appear in LDIF, so if you dump the directory into LDIF
> >> and then reload into another vendor's server and back again into your
> >> server, you don't lose any data.  Vendors will continue to use their
> >> own access control mechanisms in cases, so it is expected that in some
> >> parts of the tree that may not be ldap accessible that you'll see the
> >> use of aCIMechanism, and hence vendorACI for preservation of that
> >> information at dump/restore time.
> >> The vendorACI attribute will remain in the model.
> >
> >I don't quite follow you on this Ellen.  Shouldn't a specific,
> >alternative aCIMechanism indicate what attribute is used to store the
> >alternative ACI mechanism (even if only for export and import)?
> >
> >--
> >Mark Smith
> >iPlanet Directory Architect / Sun-Netscape Alliance
> >My words are my own, not my employer's.   Got LDAP?
> >