[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: [ldapext] Nested group


Andrew,

Andrew Findlay wrote: 
It looks as if the nested groups issue needs tackling. Should I expand
this I-D to include it?


I think that would be a good idea.

> The consensus seems to be: 

1)	groupOfEntries member attributes should not point to groups
	whose members are to be considered part of the group being
	described.
	
	I see no problem with allowing them to point to groups if
	expansion/nesting/inclusion is not required.


It is okay to restrict the interpretation of the member attribute
as an attribute of the groupOfEntries object class, but if we
consider a group as being any entry of an object class that
permits a member attribute (and/or the nestedGroup attribute),
then restricting the interpretation of the member attribute in the
more general context will conflict with some current deployments.
If we are going to allow a variety of object classes to define groups,
then we should define a new attribute, e.g., called directMember, to
replace the member attribute.

Regards,
Steven

_______________________________________________
Ldapext mailing list
Ldapext@ietf.org
https://www1.ietf.org/mailman/listinfo/ldapext