Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (athena.apache.org: domain of akarasulu@gmail.com
 designates 209.85.146.180 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:references:x-google-sender-auth;
        b=eVFEgos1q1FZ22qDbznhzIn5FyMdhgUye6a0xb2mZ4Xer2LyfY3U647mZ8fm3s+lnXkMr6c+PMZ3tX8e4ldsPSrob5CoFzYBQN3P4cDKnjk9xb7v5h53Wd004lSbUAeilFIq4IOGeDs+CL9kCKBzE17vgfDMI+Tm0YuYRg/9N9w=
Message-ID: <a32f6b020710311146h51b4a738j3227d67c1bf9b1df@mail.gmail.com>
Date: Wed, 31 Oct 2007 14:46:03 -0400
From: "Alex Karasulu" <akarasulu@apache.org>
Sender: akarasulu@gmail.com
To: "Apache Directory Developers List" <dev@directory.apache.org>
Subject: Re: [Triplesec] [AuthZ] Applications and Roles
In-Reply-To: <568FB53A-9047-4AC7-A64C-35342FF9365E@yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_9342_19716815.1193856363099"
References: <a32f6b020710241025s4be8674n5ad35190a5d64f99@mail.gmail.com>
	 <F1F1244E-CD17-4952-AB23-4A494770DF3C@yahoo.com>
	 <a32f6b020710302004v65b2044fv95e8c5b3255dd866@mail.gmail.com>
	 <568FB53A-9047-4AC7-A64C-35342FF9365E@yahoo.com>

------=_Part_9342_19716815.1193856363099
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi David,

I'm going to start condensing a bit by removing points we agree on again.

On 10/31/07, David Jencks <david_jencks@yahoo.com> wrote:

...


> that we agree on the role-permission side of roles :-)
>

Yes but not on putting users into roles.

...

I don't think so.  In my thinking a role or permission is globally unique,
> for instance if we are using ldap its "full name" might be its dn.  So far I
> can't imagine any use except increasing confusion for any concept of
> redefining.  I'll listen if you have some ideas :-)
>

We both agree on (really like) this idea of using scopes with visibility
rules.  Perhaps in a little
bit we can add more clarification to this concept and better define the
scoping rules that govern it.

...

> #2 is about Role assignment and does not belong in the definition of a
> Role.
> Roles are independent of users and groups.
>
>
> I'm not convinced.  If roles are associated to either users or groups, we
> can talk about the association at either end: either at the role end or the
> [user|group] end.
>

Well my aim was not to take any particular side by defining an entity in our
model called a
role_assignment.  The role_assignment does the association and then
direction does not matter.

Similarly we could talk about the role-permission association at either the
> role end or the permission end.  If you don't like this I'm going to request
> that we describe all the associations as separate entities so there is no
> bias about which way the association points.
>

Great this is what I've been doing all along with role assignments.
role-assignment
objects contain the associations of users to roles.  This way roles are
purely defined
as a set of references to permissions.

That's an implementation detail.
>

Not really we're still dealing with an abstract model.  Furthermore it's a
matter of being impartial.

...

Alex

------=_Part_9342_19716815.1193856363099
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi David,<br><br>I&#39;m going to start condensing a bit by removing points we agree on again.<br><br><div><span class="gmail_quote">On 10/31/07, <b class="gmail_sendername">David Jencks</b> &lt;<a href="mailto:david_jencks@yahoo.com">
david_jencks@yahoo.com</a>&gt; wrote:<br><br>...<br><br></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div style=""><br><div>that we agree on the role-permission side of roles :-)
</div></div></blockquote><div><br>Yes but not on putting users into roles.<br></div><br>...<br><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div style=""><div>I don&#39;t think so.&nbsp; In my thinking a role or permission is globally unique, for instance if we are using ldap its &quot;full name&quot; might be its dn.&nbsp; So far I can&#39;t imagine any use except increasing confusion for any concept of redefining.&nbsp; I&#39;ll listen if you have some ideas :-)
</div></div></blockquote><div><br>We both agree on (really like) this idea of using scopes with visibility rules.&nbsp; Perhaps in a little<br>bit we can add more clarification to this concept and better define the scoping rules that govern it.
<br></div><br>...<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div style=""><div><span class="q"><blockquote type="cite"><div><div>#2 is about Role assignment and does not belong in the definition of a Role. 
<br>Roles are independent of users and groups.<br></div></div></blockquote><div><br></div></span>I&#39;m not convinced.&nbsp; If roles are associated to either users or groups, we can talk about the association at either end: either at the role end or the [user|group] end.&nbsp; 
</div></div></blockquote><div><br>Well my aim was not to take any particular side by defining an entity in our model called a <br>role_assignment.&nbsp; The role_assignment does the association and then direction does not matter.
<br></div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div style=""><div>Similarly we could talk about the role-permission association at either the role end or the permission end.&nbsp; If you don&#39;t like this I&#39;m going to request that we describe all the associations as separate entities so there is no bias about which way the association points.&nbsp; 
</div></div></blockquote><div><br>Great this is what I&#39;ve been doing all along with role assignments.&nbsp; role-assignment <br>objects contain the associations of users to roles.&nbsp; This way roles are purely defined<br>as a set of references to permissions.
<br><br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div style=""><div>That&#39;s an implementation detail.<span class="q"></span>
</div></div></blockquote></div><br>Not really we&#39;re still dealing with an abstract model.&nbsp; Furthermore it&#39;s a matter of being impartial.<br><br>...<br><br>Alex<br>

------=_Part_9342_19716815.1193856363099--