On Wed, 2018-01-10 at 10:44 +0100, Ludwig Krispenz wrote:
> On 01/10/2018 07:03 AM, William Brown wrote:
> > If I have:
> >
> > (targetattr=x)(version 3.0; allow(read,
> > search)(groupdn=cn=x);)
> >
> > If cn=x has member cn=y, and cn=y member uid=z
> >
> > Does uid=z have permission to the targetattr here? IE do our aci's
> > work
> > through nested groups?
>
> yes, they should, but there is configurable max nesting level
Great! Thanks for clarifying this :)
Perhaps something we could look at is aci's resolving membership of an
entry via it's memberOf attributes if memberOf is enabled? That would
allow quicker resolution of nested groups I would think
> >
> >
>
> --
> Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn,
> Commercial register: Amtsgericht Muenchen, HRB 153243,
> Managing Directors: Charles Cachera, Michael Cunningham, Michael
> O'Neill, Eric Shander
> ___
> 389-devel mailing list -- 389-devel@lists.fedoraproject.org
> To unsubscribe send an email to 389-devel-leave@lists.fedoraproject.o
> rg
--
Sincerely,
William Brown
Software Engineer
Red Hat, Australia/Brisbane
___
389-devel mailing list -- 389-devel@lists.fedoraproject.org
To unsubscribe send an email to 389-devel-le...@lists.fedoraproject.org