Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (athena.apache.org: domain of mboorshtein@gmail.com
 designates 64.233.184.224 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=LwJdBoabVH3IVSPyQsjfYFQyav0+1KbVQpJmjQg1BfjX6K7OS9xfMQG2ocBG18bBs0jZ9GUrcB67uygtMhZ4TVz6TU88MGF+AE18P4GGpheijLqk/h0vyTfFduIRccWFc0hd4/YOg89pfoN6ffF+Ll/5AchoHJzthDd2reO35oo=
Message-ID: <800df6390709211011q5bdef748xcc628ccee0029829@mail.gmail.com>
Date: Fri, 21 Sep 2007 13:11:21 -0400
From: "Marc Boorshtein" <mboorshtein@gmail.com>
To: "Apache Directory Developers List" <dev@directory.apache.org>
Subject: Re: [ApacheDS] Specifying application level subtrees?
In-Reply-To: <a32f6b020709210940p13dc2b98k40158673018d399f@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <a32f6b020709201642p4fdbc0f9k7986a986e64ed609@mail.gmail.com>
	 <a1b4a6610709202331u1e8faddboddd7d419bb95013e@mail.gmail.com>
	 <a32f6b020709210940p13dc2b98k40158673018d399f@mail.gmail.com>

>It's essentially a means to group entries
> together and much more powerful
> than what is currently used in practice for dynamic groups: dynamic groups
> uses an LDAP URL to
> dynamically select the users for inclusion in the group.
>

Ok, I think I better understand what you are saying now.  I've seen a
lot of different group structures in directories.  From the simplest
static group to overly complex combinations of custom group entries
and custom az modules for applications.  The issue (or non issue
depending on how you look at it) is that a group is simply a directory
object.  What gives a group power is how the application deals with
the information.  The moral here being that if you have some alternate
idea of how to specify a group, i'm sure there are infinite ways of
specifying how to group users together but can the application
interpret that information?

For instance a dynamic group is much easier to manage in many ways
then a static group but applications don't generally know how to
compare a user against an ldap url.  Thats why many virtual
directories have dynamic group plugins to make dynamic groups work and
act like static groups.  So if you were to pair this group
specification idea with an interceptor that made it work like a static
group you might be on to something.

The answer to 'why dont we do it' is that applications need to be able
to consume it.  There is no az mechanism in a directory that can hide
the implementation.  Authorization is left to the applications that
are accessing the directory.


Marc