Re: [ldapext] LDAP Groups topic split-out

[Simo Sorce <[e-mail]>]

On Fri, 2015-12-04 at 16:36 +0100, Michael Ströder wrote:
> Simo Sorce wrote:
> > in fact in our project we do populate memberof
> > automatically based on the member attribute (including unrolling nested
> > relationship for the pain of those that loves non-unrolled memebrofs in
> > AD) but we also prevent access to the memberof attribute to some classes
> > (like unauthenticated guest sessions, etc..).
> 
> But it was a fault to take the very same OID and NAME for that attribute like
> 'memberOf' in MS AD because the semantics are different there (no nested groups
> referenced).

I think fault or not is a matter of perspective, we do use this
attribute for members of a group, as the description says.
But yeah it behaves in a slightly different way than AD does and in
retrospect we may have used 2 separate attributes.

> > The main issue with dealing with memberof is access control around the
> > "add" operation.
> 
> Yupp. Needs value-based access control. Does 389-DS provide ACIs like this?

Yes, it actually does, but we do not allow to modify the memberof
attributes directly, we consider it an operational attribute (although
not marked as operational :-) which is always set through an operation
on the member attribute of the target group.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York