Subject: Re: Comments on aci-model-04

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 20 Oct 1999 14:31:20 -0600

>>> <[email-masked]> 10/20/99 12:11:08 PM >>>
>> Could the fact that when group dnType is used, the target points to a
>groupOfNames be documented in > the draft?
>
>I think I'd prefer to simply add a statement that says group refers to an object
>which holds a collection of member DNs. I don't want to restrict implementations
>to using the groupOfNames objectclass if we don't have to.  Is that enough?

I still worry that it's too ambiguous.  How do I implement a server that can intuit the construction of an object which is only said to be a collection of DNs, especially when trying to interoperate in a heterogeneous environment?  Do I examine each attribute for values that look like DNs ands assume they're all part of the group?  Do I assume that there's a 'reverse membership' involved, so I search the entire directory for any entry matching name=<DN of group>? Neither of these, nor any other method I can think of makes me feel like I'm going to chance upon the actual intent of the originating implementation that this data came from.  Unless there's some consistent way of discovering exactly who is a member of the group, I'd rather it be a well known object class (or derivative).

>> Then I'm still lost on two related points. I'm still unsure of what
>constitutes a role, and I'm > > > wondering if there's a way to specify that the
>target is a subtree.
>
>We can certainly consider adding something that represents something of type
>'subtree' ( vs group or access-id ).

Thanks.

>Let me try another stab at role vs group definition. In the strict defintion,
>roles and groups are both collections of DNs. So, on the surface, they are the
>same. My understanding is that in the security world, there is a slight
>difference; not in implemenation, but in expectation.  When a user is added to a
>group that's all there is to it; he's now a member of 'Monday football
>announcements' ( or whatever ). However, when the user is added to a role, there
>is some expectation that he will receive certain permissions as a member of that
>role. For instance, when a user is added to an 'Adminstrator' group, (s)he would
>expect to have access to particular files, queues etc. ( It is still up to the
>system administrator to ensure those expectations are met )

I'm still not seeing the difference (sorry). From the perspective of ACLs, they seem the same to me.  From reading the draft, I had the impression that the difference between a group and a role is that you are included in a group (by the inclusion of your DN), and you identify yourself as performing a role by presenting some role based credentials or something.  I didn't get the feeling that a role was represented by an object which contained a set of DN's.

Jim

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 20 Oct 1999 20:25:56 -0700

At 02:31 PM 10/20/99 -0600, Jim Sermersheim wrote:
>I still worry that it's too ambiguous.

One option is to use an auxiliary objectclass called 'aCLGroup' which
requires 'member'.

However, I'd prefer not to restrict sites to 'member'... maybe
they prefer 'uniqueMember' or something completely differnet.

	Kurt

----
Kurt D. Zeilenga <[email-masked]>
OpenLDAP Project <http://www.OpenLDAP.org/>