[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Test operations

Howard Chu wrote:

Morteza Ansari wrote:

I definitely second this, SunDS also supports this control (I am not sure if the two implementations are 100% compatible though). Converging on this would make app's developers job easier.


Interesting, considering that this draft hasn't progressed very far and has no OIDs assigned. How exactly do you expect anyone to write a compatible implementation? And of course "It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress.""

Having a "standard" would be great, but "similar" implementations is better than nothing! If the implementation of SunDS and/or Netscape are interoperable and we have one that is closely related to that it is better than nothing. I know, I have low expectations!

The old draft mentioned support for X.500 access controls, but the latest draft (rev 06, 14 July 2000) doesn't mention it any more. All of which may be academic since the LDAPext working group shut down and this draft expired in January 2001.

This draft http://www.ietf.org/internet-drafts/draft-legg-ldap-acm-bac-03.txt is at least current, and the X.500 models it describes have already been widely implemented by X.500 vendors. In this respect, it doesn't have the shortcomings of the LDAPext model (which among other things doesn't allow for value-specific rights).

I don't know what Steven's plans are regarding moving this forward at IETF, but I have a feeling it probably won't get adopted by most vendors. It is unfortunately, but I think collectively we as a community failed to agree on ACL and replication and now everyone has their own implementations with little hope of ever getting to a standard solution.

Before going off and implementing an expired draft, it would be nice to understand why the model never made it beyond draft status. Surely it does not reflect well on the described model for it to have been abandoned by the authors. Nor would it reflect well on us to claim support for what can only be considered an incomplete specification.

From what I recall it was a combination of too much discussions and vendors needing a solution for their products which resulted in many un-interoperable(?) solutions.

By no means I am suggesting implementing getEffectiveRights control solves all ACL problems. However, if we are going to implement soemthing like that, we might as well implement the same one that other vendors have implemented (assuming there are no major issues with it).


Cheers,
Morteza

David Boreham wrote:

Now I'm looking to write an extended operation based on the standard, ACI or AACLs access model to allow operations testing. 




There was a 'get effective rights' extended operation
defined in the old IETF access control work:
http://www.watersprings.org/pub/id/draft-ietf-ldapext-acl-model-01.txt
I _think_ that what you are proposing is either similar or identical
to the get effective rights operation.

At least a few LDAP servers implement something like this, e.g. :
http://enterprise.netscape.com/docs/directory/621/relnotes/ger.html