[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: expansion of groups/roles/subtree subjects in LDAP ACM

To: "Kurt D. Zeilenga" <Kurt@OpenLDAP.org>
Subject: Re: expansion of groups/roles/subtree subjects in LDAP ACM
From: Ryan Moats <rmoats@lemurnetworks.net>
Date: Thu, 5 Jul 2001 16:17:56 -0500
Cc: ietf-ldapext@netscape.com
Content-disposition: inline
In-reply-to: <5.1.0.14.0.20010705123038.0356d128@127.0.0.1>; from Kurt@OpenLDAP.org on Thu, Jul 05, 2001 at 12:58:23PM -0700
References: <5.1.0.14.0.20010705123038.0356d128@127.0.0.1>
User-agent: Mutt/1.2.5i

On Thu, Jul 05, 2001 at 12:58:23PM -0700, Kurt D. Zeilenga wrote:
> How are exceptional conditions in expanding
> groups/roles/subtrees to be handled?  In particular,
> what is the ACM behavior when the groups/roles/subtrees
> cannot be fully expanded and the requestor's DN is not
> found in the partial set of DNs?
> 
> Kurt

Well as an initial (not perfect) suggestion I would opt for
notifying via the log system that the group/role/subtree
has not been fully expanded and that access has been denied
because the DN is not in the partial set.

Ryan

Follow-Ups:
- RE: expansion of groups/roles/subtree subjects in LDAP ACM
  - From: "John Strassner" <john.strassner@intelliden.com>

References:
- expansion of groups/roles/subtree subjects in LDAP ACM
  - From: "Kurt D. Zeilenga" <Kurt@OpenLDAP.org>

Prev by Date: Re: alternate "dc" naming conventions
Next by Date: RE: expansion of groups/roles/subtree subjects in LDAP ACM
Index(es):
- Chronological
- Thread