Subject: groupOfName (was: IETF ldapbis WG Last Call: draft-ietf-ldapbis-user-schema-05.txt)

From: Michael Ströder <[email-masked]>
Date: Wed, 04 Jun 2003 23:38:38 +0200

HI!

Would it be a big problem or out of scope of ldapbis to change declaration 
of object class 'groupOfNames' so that attribute 'member' is not required ?

I'd like to propose changing it to:

    ( 2.5.6.9 NAME 'groupOfNames'
       SUP top
       STRUCTURAL
       MUST ( cn )
       MAY ( businessCategory $
             member $
             seeAlso $
             owner $
             ou $
             o $
             description ) )

Similar change for object class 'groupOfUniqueNames' and attribute 
'uniqueMember'.

It's rather cumbersome having to add a dummy value for 'member' each time 
you create a group which does not have members yet.

Some server products already ship with a schema like that and personally I 
can't imagine any problem with this approach.

Ciao, Michael.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 04 Jun 2003 18:09:01 -0700

At 02:38 PM 6/4/2003, Michael Ströder wrote:
>Would it be a big problem or out of scope of ldapbis to change declaration of object class 'groupOfNames' so that attribute 'member' is not required ?

I think redesigning LDAP object class specifications is
beyond our scope.  (Note that such changes in object
class specifications generally requires assignment of
a new OID and new short names.  See X.501(93).)

Kurt

---

From: Michael Ströder <[email-masked]>
Date: Thu, 05 Jun 2003 11:51:21 +0200

Kurt D. Zeilenga wrote:
>> Would it be a big problem or out of scope of ldapbis to change
>> declaration of object class 'groupOfNames' so that attribute 'member'
>> is not required ?
> 

Is this change really so big? Do you see any incompabilities with existing 
implementations?

IMO it's a security issue that you MUST specify at least one group member 
during group creation. Admins will tend to add dummy values leading to 
inconsistent group management.

Ciao, Michael.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 05 Jun 2003 10:00:38 -0700

At 02:51 AM 6/5/2003, Michael Ströder wrote:
>Is this change really so big?

I did not attempted to answer this portion of your question.

We are only chartered to revise the LDAP technical specification
as needed to make it suitable for publication as a Draft Standard.
LDAPBIS cannot change the specification simply because we don't
like it.

>IMO it's a security issue that you MUST specify at least one group member during group creation. Admins will tend to add dummy values leading to inconsistent group management.

Sounds like something that can be addressed by a stating a
security consideration.  If the WG were to actually conclude
that the object class was significantly flawed, our best option
would be just to remove it.  Redesigning LDAP schema is beyond
our scope of work.

Kurt