[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
RE: delete permission
Hi,
It will always be possible for a client to recursively delete the subtree
using the usual delete of a leaf. Access controls, as discussed on this
thread, will still apply and have the expected outcome.
Ron.
-----Original Message-----
From: Ellen Stokes [mailto:stokes@austin.ibm.com]
Sent: Wednesday, 19 July 2000 7:56
To: d.w.chadwick@salford.ac.uk; ietf-ldapext@netscape.com;
bgreenblatt@directory-applications.com
Subject: Re: delete permission
David / Bruce,
I think the ldap model should use delete in the X.500 sense - the object
must be a leaf entry.
However, subtree delete becomes interesting if/when we decide to
surface the scope of ACI (entry/subtree) via your entryACI / subtreeACI
proposal. At that point in time, then the expired subtree drafts become
interesting because you have a way actually invoke the subtree operation
and apply access control to the operation.
Comments?
Ellen
At 06:21 PM 7/18/00 +0100, David Chadwick wrote:
> >
> > >iii) delete this entry permission. What happens if the entry has
> > >subordinates. Are permissions needed for the subordinates or not. The
> > >text is mute on this point, although it does mention that no
> > >permissions are needed on attributes in the entry.
> >
> > (EJS) The intent here was to provide the same semantic as X.500.
> > However, I think we may have missed the point you mention about
> > subordinates. It seems to me that if you the entry you're deleting is
> > a leaf entry, then no problem. If there are subordinates, then you
> > can't just delete an entry in the middle of the DIT, but also need
> > permisison to delete each subordinate. What does X.500 do?
>
>X.500 does not have this problem as only leaf entries can be
>removed. LDAPv3 basic only allows leaf entries to be deleted, but
>there was talk of having an operation to delete full subtrees. I dont
>know the status of this, do you?
>
>David
>
>***************************************************
>
>David Chadwick
>IS Institute, University of Salford, Salford M5 4WT
>Tel +44 161 295 5351 Fax +44 161 745 8169
>Mobile +44 790 167 0359
>Email D.W.Chadwick@salford.ac.uk
>Home Page http://www.salford.ac.uk/its024/chadwick.htm
>Understanding X.500 http://www.salford.ac.uk/its024/X500.htm
>X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
>Entrust key validation string MLJ9-DU5T-HV8J
>
>***************************************************