Mailing-List: contact esme-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: esme-dev@incubator.apache.org
Received-SPF: pass (nike.apache.org: domain of benewu@gmail.com designates
 209.85.211.194 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=ZJZH/eWkJmPN0EVoo47jwPhwKwZB6+KUEx4SSfV4X/kMvjfLiUOVN69IGJofvvibI6
         NJJ6U6oejecS1aSRyivrxEVqt03vi15l8KrYGA00MpTHGvkEtBN1om4T4L8tH3rGmSBN
         YUHJlgzjlCTUcm0jf0U4cKE34A8UDjY2W/GiE=
MIME-Version: 1.0
In-Reply-To: <c7fc82820909300059w72306b7es36cee99464f1debd@mail.gmail.com>
References: <fa2d9f450909300000k1dfb07eerfadd4ed15f122ad2@mail.gmail.com>
	 <c7fc82820909300059w72306b7es36cee99464f1debd@mail.gmail.com>
Date: Thu, 1 Oct 2009 11:23:47 +0800
Message-ID: <4db64d890909302023n56114990s2e6197554e63a0ed@mail.gmail.com>
Subject: Re: Deleting user from access pool
From: Xuefeng Wu <benewu@gmail.com>
To: esme-dev@incubator.apache.org
Content-Type: multipart/alternative; boundary=001636ed6b5df0ee810474d72c58

--001636ed6b5df0ee810474d72c58
Content-Type: text/plain; charset=ISO-8859-1

There're two features:1. delete users from pool;
2. delete pool.

There're some argue and my opinion:
*when delete users from pool.*
We could withdraw all messages from the user, whatever read or unread.

*when delete pool. ESME-68*
withdraw all messages
can create new pool which have the same name as deleted


On Wed, Sep 30, 2009 at 3:59 PM, Vassil Dichev <vdichev@apache.org> wrote:

> > Should we allow for a user to be deleted from an access pool?
> >
> > If yes what happens? Does he no longer have access to the messages in
> > the pool - irregardless of whether he wrote them or not?
>
> It should be possible to delete a user, yes. I think it has been
> discussed or specified in the requirements pdf that once a message is
> in the user's mailbox, it stays there, so that's how it works now. At
> any rate, deleting a message from the mailbox, which the user may have
> already seen doesn't offer any more security. A user also doesn't see
> messages in his/her mailbox, which were sent before he was added to
> the pool.
>
> The interesting part is what happens if a pool has been removed and
> whether it should be possible at all. This could pose a security
> problem if an impostor creates a pool with the same name (similar to
> what might happen with a deleted user account)
>


-- 
Global R&D Center,Shanghai China,Carestream Health, Inc.
Tel:(86-21)3852 6101

--001636ed6b5df0ee810474d72c58--