Subject: RE: delete permission

From: "Ramsay, Ron" <[email-masked]>
Date: Wed, 19 Jul 2000 12:10:41 +1000

Hi,

It will always be possible for a client to recursively delete the subtree
using the usual delete of a leaf. Access controls, as discussed on this
thread, will still apply and have the expected outcome.

Ron.

-----Original Message-----
From: Ellen Stokes [mailto:[email-masked]]
Sent: Wednesday, 19 July 2000 7:56
To: [email-masked]; [email-masked];
[email-masked]
Subject: Re: delete permission

David / Bruce,

I think the ldap model should use delete in the X.500 sense - the object
must be a leaf entry.

However, subtree delete becomes interesting if/when we decide to
surface the scope of ACI (entry/subtree) via your entryACI / subtreeACI
proposal.  At that point in time, then the expired subtree drafts become
interesting because you have a way actually invoke the subtree operation
and apply access control to the operation.

Comments?

Ellen

At 06:21 PM 7/18/00 +0100, David Chadwick wrote:

> >
> > >iii) delete this entry permission. What happens if the entry has
> > >subordinates. Are permissions needed for the subordinates or not. The
> > >text is mute on this point, although it does mention that no
> > >permissions are needed on attributes in the entry.
> >
> > (EJS)  The intent here was to provide the same semantic as X.500.
> > However, I think we may have missed the point you mention about
> > subordinates.  It seems to me that if you the entry you're deleting is
> > a leaf entry, then no problem.  If there are subordinates, then you
> > can't just delete an entry in the middle of the DIT, but also need
> > permisison to delete each subordinate.  What does X.500 do?
>
>X.500 does not have this problem as only leaf entries can be
>removed. LDAPv3 basic only allows leaf entries to be deleted, but
>there was talk of having an operation to delete full subtrees. I dont
>know the status of this, do you?
>
>David
>
>***************************************************
>
>David Chadwick
>IS Institute, University of Salford, Salford M5 4WT
>Tel +44 161 295 5351  Fax +44 161 745 8169
>Mobile +44 790 167 0359
>Email [email-masked]
>Home Page  http://www.salford.ac.uk/its024/chadwick.htm
>Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
>X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
>Entrust key validation string MLJ9-DU5T-HV8J
>
>***************************************************

---

From: Bruce Greenblatt <[email-masked]>
Date: Wed, 19 Jul 2000 22:08:55 -0700

>thread, will still apply and have the expected outcome.

While this is certainly the case, in the previous discussion on this issue
from last year, it was not agreed that the semantics of a subtree delete
were identical to the semantics of a series of "atomic" delete operations
due to access control issues.  There was some feeling that you would not
necessarily want the subtree delete operation to be partially successful.
I.e., if you couldn't delete all of the entries in the subtree, then no
entries in the subtree were to be deleted.

Bruce
==============================================
Bruce Greenblatt, Ph. D.
Directory Tools and Application Services, Inc.
http://www.directory-applications.com
See my new Book on Internet Directories:
http://www.phptr.com/ptrbooks/ptr_0139744525.html

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 19 Jul 2000 22:34:02 -0700

>entries in the subtree were to be deleted.

Another issue for subtree deletion is handling of subordinate
references with in the subtree.  In particular, are delete
continuations returned to the client?  if so, how?  Are there
ManageDSAit control issues?  Etc.

Kurt