Re: effective rights, was: Determine current access level

[Michael StrÃder <michael@stroeder.com>]

Pierangelo Masarati wrote:
> ----- "Michael StrÃder" <michael@stroeder.com> wrote:
>
> > Simon Victor wrote:
> > > > What about trying to modify/delete it with the noop control?
> > > that is a good tip, thank you at all.
> > While using the noop control may be helpful for checking whether an 
> > entry could be deleted (or another all-or-nothing operation) it's not
> > helpful to determine which attributes may be modified.
>
> Why not?  Yes, it's going to tell whether a full set of modifications
> will either succeed or fail, but nothing prevents you from performing
> repeated modifications.

Hmm, given the number of possible attributes in various combinations of 
object classes a LDAP client testing this with the noop control would be 
a real resource hog.

>  Yet you might fall into the perverse
> situation where subsequent modifications are conditioned on attribute
> values that previous modifications would have altered.  That's one of
> the reasons predicting access privileges is not possible, unless
> access to the rules is given.

Well, if in doubt the server should return 'unknown' or if that's not 
possible 'write'.

Ciao, Michael.