Subject: RE: delete permission

From: [email-masked]
Date: Tue, 18 Jul 2000 23:58:35 -0500

I agree...
Ellen

To: 

       Ellen Stokes <[email-masked]>, [email-masked],
[email-masked], [email-masked]
cc:         (bcc: Ellen Stokes/Tivoli Systems)
Subject:        RE: delete permission

Hi,

It will always be possible for a client to recursively delete the subtree
using the usual delete of a leaf. Access controls, as discussed on this
thread, will still apply and have the expected outcome.

Ron.

-----Original Message-----
From: Ellen Stokes [mailto:[email-masked]]
Sent: Wednesday, 19 July 2000 7:56
To: [email-masked]; [email-masked];
[email-masked]
Subject: Re: delete permission

David / Bruce,

I think the ldap model should use delete in the X.500 sense - the object
must be a leaf entry.

However, subtree delete becomes interesting if/when we decide to
surface the scope of ACI (entry/subtree) via your entryACI / subtreeACI
proposal.  At that point in time, then the expired subtree drafts become
interesting because you have a way actually invoke the subtree operation
and apply access control to the operation.

Comments?

Ellen

At 06:21 PM 7/18/00 +0100, David Chadwick wrote:

> >
> > >iii) delete this entry permission. What happens if the entry has
> > >subordinates. Are permissions needed for the subordinates or not. The
> > >text is mute on this point, although it does mention that no
> > >permissions are needed on attributes in the entry.
> >
> > (EJS)  The intent here was to provide the same semantic as X.500.
> > However, I think we may have missed the point you mention about
> > subordinates.  It seems to me that if you the entry you're deleting is
> > a leaf entry, then no problem.  If there are subordinates, then you
> > can't just delete an entry in the middle of the DIT, but also need
> > permisison to delete each subordinate.  What does X.500 do?
>
>X.500 does not have this problem as only leaf entries can be
>removed. LDAPv3 basic only allows leaf entries to be deleted, but
>there was talk of having an operation to delete full subtrees. I dont
>know the status of this, do you?
>
>David
>
>***************************************************
>
>David Chadwick
>IS Institute, University of Salford, Salford M5 4WT
>Tel +44 161 295 5351  Fax +44 161 745 8169
>Mobile +44 790 167 0359
>Email [email-masked]
>Home Page  http://www.salford.ac.uk/its024/chadwick.htm
>Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
>X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
>Entrust key validation string MLJ9-DU5T-HV8J
>
>***************************************************

(Embedded image moved to file: pic24227.pcx)
(See attached file: C.gif)
(See attached file: att1.eml)

---

From: [email-masked]
Date: Thu, 27 Jul 2000 16:36:42 -0500

Yes it should; in fact I believe it does.  If someone thinks there's an
undefined case we should discuss it.

--bob

Bob Blakley
Chief Scientist
Tivoli SecureWay Business Unit

"David Chadwick" <[email-masked]> on 07/25/2000 01:46:59 PM

Please respond to [email-masked]

To:   Ellen Stokes <[email-masked]>, [email-masked], Bruce
      Greenblatt <[email-masked]>
cc:    (bcc: George Robert Blakley III/Tivoli Systems)
Subject:  Re: delete permission

> A seperate but related issue to how the delete permission overrides
> the delete subtree permission, is the more general problems of how to
> treat overlapping permissions.  I don't know that there needs to be a
> general treatment, but when a new permission that is defined overlaps
> with a previously defined permission, there should be some discussion
> of the relationship.  Any thoughts?

The document is already starting to do this by giving precedence to
the different elements such as subject. Therefore I think that if
everthing can be given a pecking order/precedence, and this can be
described fully in the model doc, then everything should fall out in
the wash, shouldn't it?

David

David Chadwick