I agree... Ellen To:
Ellen Stokes <stokes@austin.ibm.com>, d.w.chadwick@salford.ac.uk, ietf-ldapext@netscape.com, bgreenblatt@directory-applications.com cc: (bcc: Ellen Stokes/Tivoli Systems) Subject: RE: delete permission [IMAGE] Hi, It will always be possible for a client to recursively delete the subtree using the usual delete of a leaf. Access controls, as discussed on this thread, will still apply and have the expected outcome. Ron. -----Original Message----- From: Ellen Stokes [mailto:stokes@austin.ibm.com] Sent: Wednesday, 19 July 2000 7:56 To: d.w.chadwick@salford.ac.uk; ietf-ldapext@netscape.com; bgreenblatt@directory-applications.com Subject: Re: delete permission David / Bruce, I think the ldap model should use delete in the X.500 sense - the object must be a leaf entry. However, subtree delete becomes interesting if/when we decide to surface the scope of ACI (entry/subtree) via your entryACI / subtreeACI proposal. At that point in time, then the expired subtree drafts become interesting because you have a way actually invoke the subtree operation and apply access control to the operation. Comments? Ellen At 06:21 PM 7/18/00 +0100, David Chadwick wrote: > > > > >iii) delete this entry permission. What happens if the entry has > > >subordinates. Are permissions needed for the subordinates or not. The > > >text is mute on this point, although it does mention that no > > >permissions are needed on attributes in the entry. > > > > (EJS) The intent here was to provide the same semantic as X.500. > > However, I think we may have missed the point you mention about > > subordinates. It seems to me that if you the entry you're deleting is > > a leaf entry, then no problem. If there are subordinates, then you > > can't just delete an entry in the middle of the DIT, but also need > > permisison to delete each subordinate. What does X.500 do? > >X.500 does not have this problem as only leaf entries can be >removed. LDAPv3 basic only allows leaf entries to be deleted, but >there was talk of having an operation to delete full subtrees. I dont >know the status of this, do you? > >David > >*************************************************** > >David Chadwick >IS Institute, University of Salford, Salford M5 4WT >Tel +44 161 295 5351 Fax +44 161 745 8169 >Mobile +44 790 167 0359 >Email D.W.Chadwick@salford.ac.uk >Home Page http://www.salford.ac.uk/its024/chadwick.htm >Understanding X.500 http://www.salford.ac.uk/its024/X500.htm >X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm >Entrust key validation string MLJ9-DU5T-HV8J > >*************************************************** [IMAGE] (Embedded image moved to file: pic24227.pcx) (See attached file: C.gif) (See attached file: att1.eml)
Attachment:
pic24227.pcx
Description: Binary data
Attachment:
C.gif
Description: Compuserve GIF
Attachment:
att1.eml
Description: Binary data
