Re: More granular privileges in ACLs (Was: (ITS#3625) [enhancement] per-operation ACLs)

[Howard Chu <hyc@symas.com>]

Kurt D. Zeilenga wrote:

> At 08:56 AM 4/2/2005, Pierangelo Masarati wrote:
>  
>
> > Here, my comment is that currently we don't save the "realdn" after an authorization: conn->c_dn is set to the authzDN; but, I admit, I need to refresh my insight into that portion of code.
> >    
> We currently don't save the real dn.
>  
>
> > If this is not true, or if keeping it around does not imply too much reworking, I think adding the "real" specifier to the above cases (and wherever applicable) should be (almost) trivial.  I'll have a look at it.
> >    
> Though about a ,real... but as the admin might want to do
> something like:  if real DN is X and effective DN is Y, grant Z,
> hence we may need "by real=X effective=Y" capability.
Yes... Although since our current "by dn=X" clause is already the 
effective DN I would leave that unchanged, and just add "realdn" thus
   access to X by dn=Y realdn=Z

with the realDN ignored if not specified (and so equivalent to current 
behavior).

--
 -- Howard Chu
 Chief Architect, Symas Corp.       Director, Highland Sun
 http://www.symas.com               http://highlandsun.com/hyc
 Symas: Premier OpenSource Development and Support