Subject: Re: [ldapext] Fwd: I-D ACTION:draft-zeilenga-ldap-managedit-00.txt

From: John McMeeking <[email-masked]>
Date: Wed, 1 Mar 2006 08:00:10 -0600

I would like to see a name for the control
that is not so close to the existing ManageDsaIT control.  I picture
someone using the wrong control because of the similarity in names.  Maybe
something along the lines of "repair DIT" or "allow exceptions"?

I have occasionally found the need for
such a mechanism.

I've always been a little uneasy about
making it too easy to use for fear that an administrator would start using
such a control for one purpose and either use it where it shouldn't have
been used -- like inadvertantly updating an entry on a read-only replica
because he misdiagnosed a problem, or using it to fix one problem and because
of the controls presence also be allowed to do something else unintended.
Or worse yet, just start using the control out of bad habit.

I'm trying to think of something that
makes the control perhaps a little less dangerous without making it impossible
to use.  In some respects, maybe what I really want is an interactive
"are you sure you want to do this" capability; of course those
always come with a "yes to all" option, so maybe I'm just unduly
paranoid.  Maybe there could be a family of controls - one control
for each kind of exceptional action - or a control value indicating the
kind of change intended.

John  McMeeking

"Kurt D. Zeilenga" <[email-masked]>
wrote on 02/28/2006 03:30:13 PM:

> Enjoy!  -- Kurt

> >To: [email-masked]

> >Cc:

> >From: [email-masked]

> >Date: Tue, 28 Feb 2006 15:50:01 -0500

> >Subject: I-D ACTION:draft-zeilenga-ldap-managedit-00.txt

> >Reply-To: [email-masked]

> >A New Internet-Draft is available from the on-line Internet-Drafts

> directories.

> >        Title
: The LDAP Manage Directory Information Tree Control

> >        Author(s)       : K.
Zeilenga

> >        Filename        :
draft-zeilenga-ldap-managedit-00.txt

> >        Pages
: 12

> >        Date
: 2006-2-28

> >This document defines the Lightweight Directory Access Protocol
(LDAP)

> >Manage Directory Information Tree (DIT) Control which allows a

> >directory user agent (a client) to request the directory service

> >temporarily relax enforcement of constraints of the X.500 models.

> >A URL for this Internet-Draft is:

> >http://www.ietf.org/internet-drafts/draft-zeilenga-ldap-managedit-00.txt

> >To remove yourself from the I-D Announcement list, send a message
to

> >[email-masked] with the word unsubscribe in the
body

> of the message.

> >You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce

> >to change your subscription settings.

> >Internet-Drafts are also available by anonymous FTP. Login with
the username

> >"anonymous" and a password of your e-mail address. After
logging in,

> >type "cd internet-drafts" and then

> >        "get draft-zeilenga-ldap-managedit-00.txt".

> >A list of Internet-Drafts directories can be found in

> >http://www.ietf.org/shadow.html

> >or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

> >Internet-Drafts can also be obtained by e-mail.

> >Send a message to:

> >        [email-masked].

> >In the body type:

> >        "FILE /internet-drafts/draft-zeilenga-ldap-managedit-00.txt".

> >NOTE:   The mail server at ietf.org can return the document
in

> >        MIME-encoded form by using the "mpack"
utility.  To use this

> >        feature, insert the command "ENCODING
mime" before the "FILE"

> >        command.  To decode the response(s),
you will need "munpack" or

> >        a MIME-compliant mail reader.  Different
MIME-compliant mail readers

> >        exhibit different behavior, especially
when dealing with

> >        "multipart" MIME messages
(i.e. documents which have been split

> >        up into multiple messages), so check
your local documentation on

> >        how to manipulate these messages.

> >Below is the data which will enable a MIME compliant mail reader

> >implementation to automatically retrieve the ASCII version of
the

> >Internet-Draft.

> >Content-Type: text/plain

> >Content-ID: <[email-masked]>

> >ENCODING mime

> >FILE /internet-drafts/draft-zeilenga-ldap-managedit-00.txt

> ><ftp://ftp.ietf.org/internet-drafts/draft-zeilenga-ldap-managedit-00.txt>

> >_______________________________________________

> >I-D-Announce mailing list

> >[email-masked]

> >https://www1.ietf.org/mailman/listinfo/i-d-announce

> _______________________________________________

> Ldapext mailing list

> [email-masked]

> https://www1.ietf.org/mailman/listinfo/ldapext

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: Michael Ströder <[email-masked]>
Date: Wed, 01 Mar 2006 16:31:22 +0100

John McMeeking wrote:
> 
> I would like to see a name for the control that is not so close to the
> existing ManageDsaIT control.

+1

> I've always been a little uneasy about making it too easy to use for
> fear that an administrator would start using such a control for one
> purpose and either use it where it shouldn't have been used

There are many possibilities for an administrator to do bad things.

> -- like
> inadvertantly updating an entry on a read-only replica because he
> misdiagnosed a problem, or using it to fix one problem and because of
> the controls presence also be allowed to do something else unintended.

There's no technical solution against dumb people.

> I'm trying to think of something that makes the control perhaps a
> little less dangerous without making it impossible to use. In some
> respects, maybe what I really want is an interactive "are you sure
> you want to do this" capability;

This is subject of client application programming but does not work for
non-interactive clients.

Ciao, Michael.

---

From: Michael Ströder <[email-masked]>
Date: Wed, 01 Mar 2006 16:53:32 +0100

Excerpt from section 3.6.:

  In absence
  of a document detailing that the NO-USER-MODIFICATION constraint on a
  particular operational attribute may be relaxed, implementors SHOULD
  assume relaxation of the constraint is not appropriate for that
  attribute.

This means a LDAP client cannot automatically determine which attributes
should be displayed as editable except a small known subset. Is that
really necessary?

I can understand your intention why you won't allow modification of
'structuralObjectClass' etc. But how about the server simply ignoring
them when sent in a modify request?

Ciao, Michael.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 02 Mar 2006 10:23:55 -0800

At 06:00 AM 3/1/2006, John McMeeking wrote:

>I would like to see a name for the control that is not so close to the existing ManageDsaIT control.  I picture someone using the wrong control because of the similarity in names.  Maybe something along the lines of "repair DIT" or "allow exceptions"? 

Noted.  How about the "relax" control?

>I have occasionally found the need for such a mechanism. 
>
>I've always been a little uneasy about making it too easy to use for fear that an administrator would start using such a control for one purpose and either use it where it shouldn't have been used -- like inadvertantly updating an entry on a read-only replica because he misdiagnosed a problem, or using it to fix one problem and because of the controls presence also be allowed to do something else unintended.  Or worse yet, just start using the control out of bad habit. 
>
>I'm trying to think of something that makes the control perhaps a little less dangerous without making it impossible to use.  In some respects, maybe what I really want is an interactive "are you sure you want to do this" capability; of course those always come with a "yes to all" option, so maybe I'm just unduly paranoid.  Maybe there could be a family of controls - one control for each kind of exceptional action - or a control value indicating the kind of change intended. 

I have considered whether the control should or should not provide
fine grained control over the relaxation of various schema restrictions
and model constraints.   I concluded it would be too hard to specify,
implement, to use (from a client perspective), to manage (from a
server policy perspective).   I concluded it was much easier to
say the control "relaxed" temporarily various restrictions/constraints,
subject to administrative and other controls.

In our early implementation, the client has to have
context-specific authorization to use this control.
That is, they need to have "manage" rights on the
object (or particular attributes of the objects)
to use this control.  It's homed that the
administrator will not grant "manage" rights to all
those who have "write" rights.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 02 Mar 2006 10:45:01 -0800

At 07:53 AM 3/1/2006, Michael Ströder wrote:
>should be displayed as editable except a small known subset.

The specification does not provide any facility for determining
whether any particular NO-USER-MODIFICATION attribute can
be modified through use of this control.  As I intend the
control to only be used in limited cases, mainly when purposely
selected by the directory administrator to undertake a task
he/she knows requires it (and is allowed by it), I saw no
need to detail which particular NO-USER-MODIFICATION constraints
can be relaxed.

>Is that really necessary?

Even without this statement, I note that implementations are
not to relax the NO-USER-MODIFICATION in cases where doing
so would be problematic.  For instance, a server should
prevent modification of modifyTimestamp is doing so would
hose directory services, such as replication or client
synchronization services.   This implies not only a need for
server implementation-specific constraints upon use of
this control, but local policy constraints.

>them when sent in a modify request?

Because then the client has no clue what modification, if
any, took place.

Of course, a client could possibly provide a "permissive
modify" control as well...

---

From: John McMeeking <[email-masked]>
Date: Thu, 2 Mar 2006 13:15:28 -0600

> >I would like to see a name for the control that is not so close
to

> the existing ManageDsaIT control.  I picture someone using the
wrong

> control because of the similarity in names.  Maybe something
along

> the lines of "repair DIT" or "allow exceptions"?

> Noted.  How about the "relax" control?

That would be better.

John McMeeking

---

From: Mark Ennis <[email-masked]>
Date: Fri, 03 Mar 2006 10:18:34 +1100

Kurt,

We implemented something very similar to this recently, which we called 
a schema checking control. The only significant difference is that we 
introduced an extra level of control.

That is, without the LDAP control, we carry out full schema checking,
with the control, we have three possible settings:
i) no schema checking.
ii) do all schema checking except the NO USER MODIFICATION property of
the attribute type description.
iii) full schema checking.

We use option ii) for importing data into the directory. It allows
createTimestamp, etc. to be specified in the dump, but otherwise checks
the schema is correct and rebuilds structuralObjectClass and
governingStructureRule.

- Mark.

Kurt D. Zeilenga wrote:
>>A New Internet-Draft is available from the on-line Internet-Drafts directories.
>>
>>
>>       Title           : The LDAP Manage Directory Information Tree Control
>>       Author(s)       : K. Zeilenga
>>       Filename        : draft-zeilenga-ldap-managedit-00.txt
>>       Pages           : 12
>>       Date            : 2006-2-28
>>       
>>This document defines the Lightweight Directory Access Protocol (LDAP)
>>To remove yourself from the I-D Announcement list, send a message to 
>>[email-masked] with the word unsubscribe in the body of the message.  
>>Internet-Drafts are also available by anonymous FTP. Login with the username
>>"anonymous" and a password of your e-mail address. After logging in,
>>NOTE:   The mail server at ietf.org can return the document in
>>       MIME-encoded form by using the "mpack" utility.  To use this
>>       feature, insert the command "ENCODING mime" before the "FILE"
>>       command.  To decode the response(s), you will need "munpack" or
>>       a MIME-compliant mail reader.  Different MIME-compliant mail readers
>>       exhibit different behavior, especially when dealing with
>>       "multipart" MIME messages (i.e. documents which have been split
>>       up into multiple messages), so check your local documentation on
>>implementation to automatically retrieve the ASCII version of the
>>Internet-Draft.
>>
>>Content-Type: text/plain

---

From: "Michael Ströder" <[email-masked]>
Date: Fri, 3 Mar 2006 08:53:34 +0100

On 7:23:55 pm 2006-03-02 "Kurt D. Zeilenga" <[email-masked]> wrote:
> > I would like to see a name for the control that is not so close to
> the existing ManageDsaIT control.  I picture someone using the wrong
> control because of the similarity in names.  Maybe something along the
> lines of "repair DIT" or "allow exceptions"?
>

I'd name it "relax DIT constrains" control.

Ciao, Michael.