Re: Considering Attribute Subtypes during ACL evaluation

[Mark Wahl <Mark.Wahl@Sun.COM>]

Prasanta Behera wrote:
> 
> Currently  the netscape/iPlanet DS ACL supports a attribute inheritance of
> subtypes e.g. if you allow access to
> "cn", it automatically means { cn, cn;* }
> 
> However, it is much harder to map "name" to "cn, sn".
> Why can't this be a UI thing? Why does it have to be
> declarative in the ACL syntax itself. It will be nice if it
> can be supported but I don't see a big reason ...

The schema and access control may be managed by different individuals.  One
can envisage a user being permitted to define a subtype of an attribute but 
not having the ability to modify access control rights.  As there are no 
rights to the new attribute, it might disappear. 

Mark Wahl
Sun Microsystems, Inc.