Quanah Gibson-Mount wrote:

Currently, ACL evaluation doesn't behave the way people always expect on ADD operations (see ITS#4556). This has been fixed in HEAD, but not currently applied to RE24. I'm currently working on 2.4.13, and wanted to gather general feedback on whether or not it is thought this change should be included. It is a distinct change in behavior, and will break expected behavior for some folks.

Wasn't it suggested to add a configuration switch to allow turning it off, at least for the lifespan of 2.4? Much like what happened with schemacheck.

p.

Ing. Pierangelo Masarati OpenLDAP Core Team

SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando@sys-net.it -----------------------------------

Quanah Gibson-Mount wrote:

Well, no such keyword exists right now in HEAD. ;) If it gets added, then yeah, this would be a no-brainer. :) Howard says he'll take a look at doing that.

I could do it as well, but probably not before the we (as usual :)

p.

Ing. Pierangelo Masarati OpenLDAP Core Team

SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando@sys-net.it -----------------------------------

Howard Chu writes:

I'm leaning toward add_attr_acl but not too thrilled with that. It's hard to come up with a meaningful name that doesn't get overly verbose. Any other suggestions?

Is this a per-database on/off option defaulting from a global setting, or just a global "on if included" option?

Nitpick, but I would call it "access<something>" so it sorts next to "access".

Hallvard B Furuseth wrote:

Howard Chu writes:

...

I'm leaning toward add_attr_acl but not too thrilled with that. It's hard to come up with a meaningful name that doesn't get overly verbose. Any other suggestions?

Is this a per-database on/off option defaulting from a global setting, or just a global "on if included" option?

It's a per-DB boolean, yes. Default is off. (Except for cn=config, which will default on.)

Nitpick, but I would call it "access<something>" so it sorts next to "access".

Currently I'm using 'add_content_acl' and add* sorts next to "access"...

On Mon, Nov 10, 2008 at 12:01:16PM -0800, Quanah Gibson-Mount wrote:

Currently, ACL evaluation doesn't behave the way people always expect on ADD operations (see ITS#4556). This has been fixed in HEAD, but not currently applied to RE24. I'm currently working on 2.4.13, and wanted to gather general feedback on whether or not it is thought this change should be included. It is a distinct change in behavior, and will break expected behavior for some folks.

It is not clear from the ITS page exactly what the fix eventually was. The discussion turned to ditStructureRules at followup 6, and by followup 8 it appears that the issue is considered 'fixed'.

I assume that the fix was to enforce ACLs on the attributes of an entry before adding it, as originally requested in the ITS. This will need a note in the Admin Guide, but it seems like a Good Thing To Do. I would consider the old (non-enforcing on add) behaviour to be wrong so I would not be worried by the ACLs being enforced in a future version.

Andrew

Emmanuel Dreyfus wrote:

Howard Chuhyc@symas.com wrote:

...

I'm leaning toward add_attr_acl but not too thrilled with that. It's hard to come up with a meaningful name that doesn't get overly verbose. Any other suggestions?

A more general syntax, leaving room for more settings: attr_acl mod; attr_acl add,mod; attr_acl all; (default, currently add,mod)

But in this case I don't think we want any more generality. No one should be turning off ACL checks on mod (or any other) operations...