[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Consumer ACLs

On Wednesday, 6 January 2010 00:45:12 Jaap Winius wrote:
> Hi all,
> 
> A question regarding ACLs on OpenLDAP consumer servers. If the ACLs on
> the provider give clients write access to some attributes, such as
> loginShell or userPassword, shouldn't the ACLs on the consumers do the
> same?

No.

> I'm not sure about this, since consumer databases are always
> read-only, but it seems to me that the clients would otherwise have no
> way of knowing that changing certain attributes was possible (via the
> updateref option or the chain overlay).

ACLs won't be evaluated on the slave in either case, the referral will occur 
first.

(How do clients "know" that certain attributes can be changed? In practice, 
they don't, they try to make change, and if they get a referral, they may or 
may not try and chase the referral).

Regards,
Buchan