Re: ACL model comments

[Mark Wahl <M.Wahl@INNOSOFT.COM>]

> I agree that the attribute type used to store access control information
> should be operational.  X.500's various access control attribute types
> are defined with "USAGE directoryOperation" which seems right to me.

I'd agree with that.  This usually indicates that it is used by the directory
service itself, is replicated with user attributes (not server specific), 
and may be modifiable oer protocol.

> I admit that 'aci' was not a good name for Netscape to use, but I
> suggest we use a name like 'ldapACI' for the new standard scheme to
> avoid confusion (unless someone else is already using that name too!).

I've seen aci, acl, subtreeacl, searchacl, but haven't seen ldapACL yet.

Mark Wahl, Directory Product Architect
Innosoft International, Inc.