[Date Prev][Date Next]
Re: (ITS#3625) [enhancement] per-operation ACLs
>what out for manage (m) and disclose (d) permissions.
without any intention to revitalize the <draft-ietf-ldapext-acl-model>,
to fulfil the requirement of this ITS we should at least borrow some of
its concepts. I note that our (d) borrows (and may partially extend)
the "t: returnDN" privilege of that draft, while our (m) is not
paralleled, at least in the broad (and loose) meaning we're discussing,
like allowing the structuralObjectClass to be changed and so.
There's a lot of granularity we may want to borrow (perhaps too much) in
Permissions which apply to attributes:
w Write Modify-add values
o Obliterate Modify-delete values
m Make Make attributes on a new entry below
a Add Add an entry below this entry
d Delete Delete this entry
e Export Export entry & subordinates to new
i Import Import entry & subordinates from some
n RenameDN Rename an entry's DN
I think the "i: Import" and "e: Export" are a (perhaps excessive)
granularization of (m) manage, yet some extra management granularity and
generality is missing to account for other non-user allowed internal
Finally, the granular options should be logically grouped under the
umbrella of the current OpenLDAP privileges, to ease transition and in
general configuration whenever grnularity is not needed.
So (using the extended names to avoid confision):
disclose returnDN (and more)
read Read, BrowseDN
write Write, Obliterate, Make, Add, Delete, RenameDN
manage Export, Import (and more)
If there's consensus on implementing all (or some) of these, and on the
grouping I can (fast?)prototype an implementation.
SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497