Re: [ldapext] LDAP Groups topic split-out

[Michael Ströder <[e-mail]>]

Charlie wrote:
> After reading David Foster Wallace on set theory, I wrote an RFC a
> couple years back to address the lack of a generic or globally useful
> grouping mechanism in LDAP-accessible directories.  Comments are
> welcomed.
> 
> http://typinganimal.net/rants/textify.php?f=draft-brooks-ldap-sets-00.txt

Although you will likely claim that your I-D also describes the problem in
general you're already endorsing a particular solution. :-/

I suspect that your mixed use of values in attribute 'psetMembership' will
rather contribute to the "hodgepodge of LDAP schema" you criticize than solving
problems.

Personally I don't see a strong need for generic "ur-objects" because one can
easily define such a schema for a particular deployment with custom schema with
particular semantics.

> If you're not up for a long-read, I would recommend just reading
> "Appendix D:  Other Efforts and their Shortcomings" which explains all
> the attempts to date and how they've failed to gain traction.

I agree with some of your points therein. But you have a wild mix of true issues
on one side and bad common practice with dummy objects on the other hand.

I'd say we should:
1. fix true issues (e.g. empty-group-problem) with a new I-D.
2. Add text (implementation notes, security considerations etc.) to prevent bad
practice.

For 2. you will never find text which prevents all people to shoot themselves in
the foot.

Ciao, Michael.