Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: <derby-dev@db.apache.org>
Received-SPF: neutral (asf.osuosl.org: local policy)
Message-ID: <43ECDBA6.9080204@apache.org>
Date: Fri, 10 Feb 2006 10:29:58 -0800
From: Daniel John Debrunner <djd@apache.org>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
 rv:1.7.3) Gecko/20040910
MIME-Version: 1.0
To: derby-dev@db.apache.org
Subject: Re: Grant and Revoke, Part II ... DERBY-464...
References: <435FCD22.3050607@Sourcery.Org>
 <43909A64.5020205@Sourcery.Org>	 <7921d3e40512220208u44bb2a54se440d79de684be1@mail.gmail.com>
	 <43AAC668.5080401@debrunners.com>
 <43AB1471.2090109@Sourcery.Org>	 <43BEFBF1.9000901@Sourcery.Org>
	 <7921d3e40601061559r288367cco9e572d4602ed7d2e@mail.gmail.com>
	 <43C21400.7010703@Sourcery.Org>
 <7921d3e40601100912n75b8570bh8f5b5672799f7324@mail.gmail.com>
 <43C3F711.4010804@apache.org> <43C4A03C.8030603@apache.org>
 <43C4DE91.8050207@Sourcery.Org> <43C52573.4020508@apache.org>
 <43EA75CE.3040203@Sourcery.Org>
In-Reply-To: <43EA75CE.3040203@Sourcery.Org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Satheesh Bandaram wrote:

> I am not sure if previous discussion about migrating a legacy mode
> database to Grant Revoke model was finalized. It seems there were two
> thoughts:
> 
>    1. Keep authorization models separate. Legacy mode database can be
>       migrated to sqlStandard model by connecting with a URL property.
>       (sqlAuthorization=true)
>    2. Dan proposed combining both models with Grant and Revoke
>       capability being seen as adding fine-grain access control on top
>       of current model. While this proposal doesn't impact Grant and
>       Revoke work being done currently by much, it may have implications
>       on some future work. (like system privileges) This does make it
>       easier for existing databases to adapt new capabilities.

I guess I don't understand how 1) is useful. In this mode by adding
grant/revoke in its current form you are removing key authorization
options. For example if I'm using an LDAP authentication scheme I won't
be able to limt the set of authenticated LDAP users who can connect to
my database. I can do that now, and with 2) I can do that and have more
fine grained authorization.

Dan.