Re: filters in ldapACI (WAS Re: I-D ACTION:draft-ietf-ldapext-acl-model-06.txt)

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 02:53 PM 7/25/00 +0100, David Chadwick wrote:
>Kurt said
>
>> Though both X.500 subentry and ldapACI offer sophisticated
>> scoping specification mechanisms, the X.500 subentry is a general
>> mechanism which can be applied to numerous features.  That is, a
>> server can implement the subentry complexity once and then apply it to
>> multiple features.  ldapACI's mechanism is specific to the feature it
>> provides.   Other attributes would have to define it's own scoping
>> mechanisms (or use X.500's subentry provided mechanism).
>> 
>
>I am not sure whether you are arguing for or against the X.500 
>subentry type of mechanism in your statements above? Or was it 
>just an observation?

I making a argument for a common scoping mechanism that can be
applied to multiple attributes.  I believe having per attribute
scoping mechanisms, such as ldapACI's subtree mechanism, is a
bad idea.

Kurt