[Date Prev][Date Next]
Re: (ITS#6198) Authorization for extensions
Howard Chu wrote:
> Michael Ströder wrote:
>> hyc@OpenLDAP.org wrote:
>>> Full_Name: Howard Chu
>>> Version: HEAD/2.5
>>> URL: ftp://ftp.openldap.org/incoming/
>>> Submission from: (NULL) (188.8.131.52)
>>> Submitted by: hyc
>>> The access control mechanism needs to be extended to control actions,
>>> not just
>>> objects, to control who may use various LDAP Controls and Extended
>>> access to control=<oid> by<who>
>>> access to op=<operation or oid> by<who>
>> What is "operation" supposed to be? I'd prefer only to allow "oid" since
>> OIDs are the only identifiers clearly specified in RFCs and I-Ds.
> Ugh, no. There's no way any sysadmin is going to remember what each OID
There are tools to display them:
There also could be GUI tools to display ACLs to humans.
> Each exop will be given a "friendly name" like WhoAmI, ModifyPwd,
Who maintains the list of friendly names? Yes, the OpenLDAP project can
maintain a proprietary list like all other LDAP vendors do. :-(
Probably that's another topic for cross-vendor coordination...