Subject: LDAPv3 Rights Family in draft-ietf-ldapext-acl-model-04.txt.

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 13 Oct 1999 10:57:58 -0600

In section 6.2.1.1, the rights defined (Read, Write, etc) are preceeded by numbers and there is the statement "The rights may be ORed...", but the way these are specified in the aci syntax is by listing alphabetical abreviations (r,w).  It looks like the numbers and the OR language is a holdover from something else and should be removed or replaced by the abreviations.

The LDAPv3 Rights family also contains one right (Search) which isn't specified in the BNF (under the permissions section).

Then there is a typo in the explanation of manage/use/get/set, "pointer" should be "printer".

Jim

---

From: "Ken Peirce" <[email-masked]>
Date: Wed, 13 Oct 1999 12:47:46 -0700

I'll apologize for bringing this up if it's a settled issue, but I didnt'
see this issue discussed in the archives:

How does LDAP fit into the policy picture with COPS and the AAA WG work? I
understand that COPS is supposed to transport request and decision objects
between a policy server and a router(enforcer). Policy is frequently a
per-user centric item.

Most ISPs I've spoken to want to put policy details for a specific user in a
schema of some sort. However, it would seem that LDAP could transport the
policy enforcement information to the enforcer itself. Do we have to have an
LDAP policy server that is queried by a COPS policy server that is queried
by an enforcer?

If a document exists that explains the larger picture here I would be
grateful for a pointer.

Ken

---

From: Ellen Stokes <[email-masked]>
Date: Tue, 19 Oct 1999 05:07:50 -0500

At 10:57 AM 10/13/1999 -0600, Jim Sermersheim wrote:
>In section 6.2.1.1, the rights defined (Read, Write, etc) are preceeded by
numbers and there is the statement "The rights may be ORed...", but the way
these are specified in the aci syntax is by listing alphabetical
abreviations (r,w).  It looks like the numbers and the OR language is a
holdover from something else and should be removed or replaced by the
abreviations.

Yes, this section is out-dated and needs revision.  The BNF for the rights
is correct.

>
>The LDAPv3 Rights family also contains one right (Search) which isn't
specified in the BNF (under the permissions section).

Yes, the search right in the BNF is missing.  I'll add the search right as
's' and change the
set right to 'p' (put).

>Then there is a typo in the explanation of manage/use/get/set, "pointer"
should be "printer".

OK.