Subject: [ldapext] Directory Best Practice Guide

From: [email-masked]
Date: Fri, 16 Aug 2002 10:27:02 -0400

Mark/Roland,

It seems that we have enough people who want to work on Directory Best
         Practice.
Can we do this work under ldapext?

-Christine Yoon
PricewaterhouseCoopers
cell: (201)981-1172
office: (732)706-3559
_________________________________________________________________
         The information transmitted is intended only for the person or
         entity to which it is addressed and may contain confidential
         and/or privileged material.  Any review, retransmission,
         dissemination or other use of, or taking of any action in reliance
         upon, this information by persons or entities other than the
         intended recipient is prohibited.   If you received this in error,
         please contact the sender and delete the material from any
         computer.

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: Mark Wahl <[email-masked]>
Date: Fri, 16 Aug 2002 10:54:18 -0500

> Can we do this work under ldapext?

Not in the LDAPEXT working group, because the LDAPEXT working group has shut
down several meetings ago and so is not taking new work items.

If you wish to have Directory Best Practice be a work item in the IETF, 
you would either want to find an active working group that would be willing
to sponsor this, request to create a new working group for this purpose, or 
just start an discussion list for directory best practice to develop 
individual drafts and perhaps determine if there is sufficiently broad 
interest and sufficiently narrow problem scope to create a WG.   Note that 
there have been attempts in the past to create a working group for this kind 
of problem area but these have not lasted, so the first or third approach is
the one I would recommend.

Mark Wahl
Sun Microsystems Inc.

---

From: Collado T Luis E <[email-masked]>
Date: Mon, 19 Aug 2002 10:12:22 -0400 (VET)

hi, Mr. Wahl, i am a student of the UCV (Universidad Central de
Venezuela).
I want to know: what is the difference between the groupofnames and
groupuniquenames objectclass?

Thanks.

***********************************
*   Luis Eduardo Collado Tovar     *
*  Estudiante de Lic. Computación  *
*      Facultad de Ciencias        *
* Universidad Central de Venezuela *
*       Caracas.- Venezuela        *
************************************

---

From: Mark Wahl <[email-masked]>
Date: Mon, 19 Aug 2002 11:21:46 -0500

> groupuniquenames objectclass?

groupOfNames has the member attribute and groupOfUniqueNames has the 
uniqueMember attribute.  This is defined in RFC 2256.

The syntax of the member attribute is just a DN.   The syntax of the 
uniqueMember attribute is a DN and an optional unique identifier.  This is
defined in RFC 2252.   The unique identifier is a bit array, I believe.

The uniqueMember comes from X.500(1993) which wanted to have a way to 
protect the group-based access control from a situation where an entry 
might be deleted and then another entry added with the same DN.  If you
want to ensure that the old group membership check does not permit the 
new entry, then you would use groupOfUniqueNames to form the group, and
have a different uniqueIdentifier value in each instance over time of an
entry.

David Chadwick's book has a chapter on X.500 access control:
http://www.isi.salford.ac.uk/staff/dwc/Version.Web/Chapter.8/Chapter8a.htm

The member attribute is generally not as widely used as uniqueMember, as 
mMany non-X.500-based implementations of LDAP servers as well as LDAP clients
tend to treat the uniqueMember attribute as being DN-valued and don't use
the optional unique identifier.

Hope this helps,

Mark Wahl
Sun Microsystems Inc.