[Date Prev][Date Next]
Re: More granular privileges in ACLs (Was: (ITS#3625) [enhancement] per-operation ACLs)
Kurt D. Zeilenga wrote:
At 08:56 AM 4/2/2005, Pierangelo Masarati wrote:Yes... Although since our current "by dn=X" clause is already the
effective DN I would leave that unchanged, and just add "realdn" thus
Here, my comment is that currently we don't save the "realdn" after an authorization: conn->c_dn is set to the authzDN; but, I admit, I need to refresh my insight into that portion of code.We currently don't save the real dn.
If this is not true, or if keeping it around does not imply too much reworking, I think adding the "real" specifier to the above cases (and wherever applicable) should be (almost) trivial. I'll have a look at it.
Though about a ,real... but as the admin might want to do
something like: if real DN is X and effective DN is Y, grant Z,
hence we may need "by real=X effective=Y" capability.
access to X by dn=Y realdn=Z
with the realDN ignored if not specified (and so equivalent to current
-- Howard Chu
Chief Architect, Symas Corp. Director, Highland Sun
Symas: Premier OpenSource Development and Support