Subject: Re: Comments on aci-model-04

From: [email-masked]
Date: Mon, 25 Oct 1999 10:58:27 -0500

All:

There's been several requests for the concept of an acl applying to a
subtree of DNs.

The proposal on the table is to add an additional identifier to the subject
Type : subtree. Subtree would mean that the aci entry would apply to the DN
and all descendants of that dn.
aci: 1.2.3.4#entry#grant;r;w;[all];#subtree#ou=Org,c=Country
This aci would be applicable to: ou=Org,c=Country ,   cn=Group1
,ou=Org,c=Country etc.

Including subtree, the precedence order for subject Types would be:
(Lowest- least specific) subtree - role - group - accessId ( highest - most
specific )

I don't really like using the term subtree here, since it's already been
used in the BNF. I rather use a distinct term so there isn't any confusion,
so if anyone can think of another term, please speak up.

Debbie

INet: [email-masked]
Lotus Notes : djbyrne@ibmus
Phone: (512)838-1930 ( T/L 678 )

---

From: [email-masked] (Prasanta Behera)
Date: Mon, 25 Oct 1999 12:18:59 -0700

> This aci would be applicable to: ou=Org,c=Country ,   cn=Group1

Does this mean that  "the aci is applicable" or  "anyone within
ou=org,c=country" has the privilege ? I am thinking it's the latter.

I would suggest a more general approach of using filters here.
aci: 1.2.3.4#entry#grant;r;w;[all];#(filter)#ou=Org,c=Country

/prasanta

---

From: Erik Skovgaard <[email-masked]>
Date: Mon, 25 Oct 1999 16:46:10 -0700

Debbie,

The correct term is "prescriptive ACI".

BTW, it would be nice if we could specify the end of the tree, too.

Cheers,              ....Erik.

--------------------------------
Erik Skovgaard
Enterprise Directory Engineering
GeoTrain Corp
(Global Knowledge Network)
http://www.geotrain.com