Subject: Re: Considering Attribute Subtypes during ACL evaluation

From: [email-masked]
Date: Sat, 30 Sep 2000 07:12:59 -0400

Jim,

Good question!

I know that implementing access control such that attribute inheritance 
were taken into account would definitely be harder, but I feel that 
attribute inheritance SHOULD be considered during access control checks.

Thus, if some entity is granted read and write privileges to 'name', then 
they should be allowed the same privileges to 'cn', 'sn', and 
'cn;lang-en'.  (unless overidden by another permission that disallows such 
access).

Regards,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Endicott/IBM@IBMUS or IBMUSM00(HAHNT)
phone: 607.752.6388     tie-line: 8/852.6388
fax: 607.752.3681

To:     <[email-masked]>
cc:     "Duane Buss" <[email-masked]> 
Subject:        Considering Attribute Subtypes during ACL evaluation

Are attribute subtypes considered when calculating access  control 
information? In other words, if I have read permission to the "name" 
attribute, does that automatically give me read permission to sn, cn, 
givenName,  etc?
 
I can't find any coverage of this in X.511 or the latest ACL  draft. Due 
to the lack of anyone talking about it, my assumption is that, no, 
permissions do not flow down attribute inheritance chains, they must be 
explicitly stated for each attribute.
 
Of course with LDAP, this brings up the question of whether  they apply to 
attribute type options. It seems to make sense, under most  circumstances, 
to apply them in this case. Oh, what a world - what a  world.

---

From: [email-masked] (Prasanta Behera)
Date: Sat, 30 Sep 2000 07:39:09 -0700

Currently  the netscape/iPlanet DS ACL supports a attribute inheritance
of subtypes e.g. if you allow access to
"cn", it automatically means { cn, cn;* }

However, it is much harder to map "name" to "cn, sn".
Why can't this be a UI thing? Why does it have to be
declarative in the ACL syntax itself. It will be nice if it
can be supported but I don't see a big reason ...

thanks,
/prasanta

[email-masked] wrote:

>
> Jim,
>
> Good question!
>
> I know that implementing access control such that attribute
> inheritance were taken into account would definitely be harder, but I
> feel that attribute inheritance SHOULD be considered during access
> control checks.
>
> Thus, if some entity is granted read and write privileges to 'name',
> then they should be allowed the same privileges to 'cn', 'sn', and
> 'cn;lang-en'.  (unless overidden by another permission that disallows
> such access).
>
> Regards,
> Tim Hahn
>
> I can't find any coverage of this in X.511 or the latest ACL  draft.
> Due to the lack of anyone talking about it, my assumption is that,
> no,  permissions do not flow down attribute inheritance chains, they
> must be  explicitly stated for each attribute.
>
> Of course with LDAP, this brings up the question of whether  they
> apply to attribute type options. It seems to make sense, under most
> circumstances, to apply them in this case. Oh, what a world - what a
> world.
>

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 30 Sep 2000 11:59:03 -0700

At 07:39 AM 9/30/00 -0700, Prasanta Behera wrote:
>Currently  the netscape/iPlanet DS ACL supports a attribute inheritance of subtypes e.g. if you allow access to 

Depends upon your server implementation...  I argue that
mapping "name" to "cn" is no harder than mapping "2.5.4.3"
to "cn".  Both require schema aware ACL evaluation and
once you have that, supporting subtyping is likely no big
deal. Implementing schema aware ACL evaluation may be hard,
but it's already required to handle alternative naming
of attribute types.

However, given that subtyping is optional in LDAPv3, one
could argue it's best to leave subtyping within ACLs as
being optional.

Kurt