Subject: [ldapext] draft-zeilenga-ldap-readentry-01.txt

From: "Andrew Sciberras" <[email-masked]>
Date: Wed, 17 Dec 2003 09:04:02 +1100

G'Day,

The following text can be found in section 3.1 and 3.2:

~~~~~~~~~~~~~~~~~
  The server is to return a SearchResultEntry containing, subject
  to access controls and other constraints, values of the requested
  attributes.

  The normal processing of the update operation and the processing of
  this control MUST be performed as one atomic action isolated from
  other update operations.

  If the update operation fails, no response control is provided.
~~~~~~~~~~~~~~~~

On one hand, the first paragraph implies that if the read fails due to
access control restrictions, then no values should be returned.
On the other hand, paragraph two indicates that if the read fails (possibly
due to access controls) then the entire operation should fail.
Paragraph 3 explicitly states that if the update fails then the read should
as well, but fails to address the alternate scenario.

What happens if the read operation fails due to the user not having
sufficient access rights?
Should the update succeed or fail?

Thanks,

Andrew Sciberras
View500 Software Engineer
Adacel Technologies
http://view500.adacel.com

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 16 Dec 2003 22:10:40 -0800

>The following text can be found in section 3.1 and 3.2:

The first paragraph implies that the contains of the entry
is subject to access controls which may cause some subset
of the attributes to be returned and, for those attribute
returned, some subset of their values.  The returned entry
could, in fact, have no attributes.

>due to access controls) then the entire operation should fail.

As with normal search processing, it is not generally viewed
as a failure to subject attributes (or values thereof) to access
controls.  However, there may be cases where it is appropriate
for the control processing to fail with insufficientAccessRights.
However, as LDAP doesn't have an standard access control model,
I purposely avoid providing examples which might case such
failures.

>as well, but fails to address the alternate scenario.

"update operation" is intended to encompass both normal and
control processing.  I will clarify.

>sufficient access rights?  Should the update succeed or fail?

If the control processing fails, regardless of reason, than
THE operation fails.  If the operation fails, the entry
MUST NOT be updated and read response control(s) MUST NOT
be provided.

Kurt