directory-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From David Jencks <>
Subject Triplesec... storing permissions in ldap
Date Sat, 23 Dec 2006 22:33:30 GMT
Right now triplesec is basically using strings as permissions, and  
they are stored as multi-valued attributes like so:

objectclass ( NAME 'policyRole'
     SUP top
     MUST ( roleName )
     MAY  ( grants $ denials $ description ) )

objectclass ( NAME 'policyProfile'
     SUP top
     MUST ( profileId $ user )
     MAY  ( grants $ denials $ roles $ userPassword $ description $  
safehausDisabled ) )

or as a bit of ldif:

objectClass: top
objectClass: policyRole
grants: mockPerm9
grants: mockPerm7
grants: mockPerm5
grants: mockPerm4
denials: mockPerm6
roleName: mockRole5

(this includes my local modification so roles can have denials).

After looking around at I think we can  
store 99% of them with 3 strings:

and possibly depending on how ldap datamodels work

Within a role or profile, these 3 or 4 strings are needed to get a  
unique permission.

I've been trying to learn about ldap schemas, the data model, ldif,  
etc by figuring out how to fit this info into ldap but I'm pretty  
bewildered and maybe someone with non-zero experience could review  
and improve my suggestion below or suggest how to proceed.

It looks to me as if one way to proceed would be to have the  
className with permissionNames grouped under each labelled grant or  
deny, then with the actions as attributes on the permission.  Does  
the following schema do this?

attributetype (
         NAME 'action'
         DESC 'action for a permission'
         EQUALITY caseExactMatch
         SUBSTR caseExactSubstringsMatch
         SYNTAX )

objectclass ( NAME 'className'
     SUP top

objectclass ( NAME 'grant'
     SUP top
     MAY  ( action )

objectclass ( NAME 'deny'
     SUP top
     MAY  ( action )

I'm imagining a dn something like


with attributes like

Some of my other questions are...  AUXILIARY or STRUCTURAL?
What if anything ties the object classes together in a tree, so e.g.  
grant and deny occur "inside" className?  Should there be MAY ( grant  
$ deny) in the className objectclass?
The actions and possibly the grant/deny are likely to have lots of  
bizarre punctuation, such as the commas in the example above.  How  
does one deal with that in ldap?

Many thanks for any help, and I hope this isn't too much of a user  
list question :-)

david jencks

View raw message