Re: [ldapext] DBIS - new IETF drafts

[Howard Chu <[e-mail]>]

Charlie wrote:
> What I have learned from about a decade of quietly following LDAP
> across multiple forums and lists is the following:

> 2) POSIX group semantics are the bane of open-source LDAP.  The
> functional paradigm that a member is an attribute of a group is
> fundamentally broken; group membership is an attribute of the member.
> The security concerns frequently raised concerning this are all either
> trivially solvable or pragmatically completely bogus.

Sorry but that makes no sense. It's the same as saying 'element e is a member 
of set S' is true but 'set S contains element e' is false. If one is true then 
both must be true.

Of course there are two different ways to view it. From a sysadmin's point of 
view, what is important is knowing which users are the member of a group. From 
an individual user's point of view, knowing which groups they belong to is 
more important. In real life, users will login many times more frequently than 
sysadmins will manipulate group memberships, so you may decide that optimizing 
for the user check is more important. But while sysadmin manipulation may be 
infrequent, the consequences of making a mistake are high, so data models up 
till now have been designed to make the sysadmin view more straightforward. 
Complexity for the user's perspective is simple to automate and never have to 
worry about ever again.

I think it would be a mistake to lose sight of this distinction.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/