Subject: Manage, Use, Set, Get rights in draft-ietf-ldapext-acl-model-04.txt

From: "David Ward" <[email-masked]>
Date: Tue, 12 Oct 1999 17:06:56 -0600

The document defines a set of rights that apply to the object to which the directory entry points ( Manage / Use / Get / Set ).  Your example shows how these could be applied to a printer.  However, they are very vague and I think vendors will want to have specific rights for objects such as printers or computers.  Using your printer example, people may want to separate the rights for starting/stopping queues and flushing queues.  Flushing a queue is a destructive operation.  Trying to lump operations together under these coarse groups will probably not work well and ldap server vendors will undoubtedly group the operations differently (Manage for vendor A may be start/stop queue and Manage for vendor B may be start/stop/flush).  

I would suggest removing this set of rights from the document.  The acl model allows for other access control mechanisms and rights families to be defined.  I could see groups getting together to propose a standard set of printer rights or a standard set of computer rights, or a set of rights for executing specific controls within the directory.

David