[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: querying ACLs

To: Shane <squindler@gmail.com>
Subject: Re: querying ACLs
From: Hallvard B Furuseth <h.b.furuseth@usit.uio.no>
Date: Tue, 15 May 2007 17:29:08 +0200
Cc: openldap-software@openldap.org
In-reply-to: <10badf220705142301k33d9d36eh743fc6c588cb9892@mail.gmail.com>
References: <10badf220705142301k33d9d36eh743fc6c588cb9892@mail.gmail.com>

Shane wrote:
> Is it possible to "query" what permissions an "entity" has prior to
> them trying to make a change or addition?

Well, you can send an update operation with the noop (No Operation)
control attached.  Then the server will not perform the operation, but
it'll (try to) tell you if you have access to perform it.  Some backends
support it, some don't.

However the result doesn't necesarily tell you if you'd have access to
perform some slightly different operation, so you have to treat the
result as a hint.  It depends on the access controls in the server,
which can be quite complex.

-- 
Regards,
Hallvard

References:
- querying ACLs
  - From: Shane <squindler@gmail.com>

Prev by Date: Re: (raise question again) how to configure LDAP to allow each logged-in user to modify the subtree of the current user?
Next by Date: Re: querying ACLs
Index(es):
- Chronological
- Thread