Re: ldapACI permissions

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 11:12 AM 3/22/00 -0700, Jim Sermersheim wrote:
>I think it would be very hard and not very useful to allow one to have 'a' or 'd' rights, and not 'w'. This is especially true when the identity with 'a' rights doesn't have 'w' rights to mandatory attributes. I think certain rights should imply other rights. Maybe a set of 'implication rules' is needed. Something like:
>

This is just food for thought:

Have used access levels ("write" => "read" => "search" => "compare") in OpenLDAP
for some time, I have only found a couple of cases (such as disallow search
of readable attribute) where discrete permissions would have been extermely
useful.  These cases were enough to convince me that we should add support
for such.

What our devel code now supports both, it can be viewed (simplification):
	"write" is "=wrsc"
	"read" is "=rsc"
	"search" is "=sc"
	"compare" is "=c"

where the "=" sign is used to flag indicate the value is a discrete set of
permissions.  If you wanted to grant "r" but not "sc", you'd say "=r".