RE: denyop

["Howard Chu" <hyc@highlandsun.com>]

> -----Original Message-----
> From: Pierangelo Masarati [mailto:ando@sys-net.it]

> > I suppose we could define a separate flag for
> SLAP_RESTRICT_OP_WRITE and
> > include it in SLAP_RESTRICT_OP_WRITES. At the moment I'm not too
> > concerned about it. However, we have a hole in here at the moment
> > because
> > SLAP_RESTRICT_OP_WRITES doesn't catch EXOP_MODIFY_PASSWD
> and probably
> > should.
>
> That's mostly the solution I was about to move towards,
> to allow readOnly to be enabled/disabled leaving the
> previous granular restrictions unchanged.  I'd also
> like to centralize (at the frontend) an exop structure
> that avoids the duplications we're having of static OID
> bervals plus flags, function pointes and so.  At the same
> time, I'd like to add a "does write" flag to those exops
> that require it, so that they can be captured by readOnly.

Sounds good.

If any other Writing exops come along, and their changes can't easily be
mapped into existing Add/Modify ops, we're going to need a way to represent
them in a log/LDIF (replog or auditlog)...

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support