Hi William,
A couple of questions (as usual... :)
On 02/26/2017 03:51 PM, William Brown wrote:
Hi,
I think that we should have a flag of a backend as local or remote for
DS.
Does the remote backend mean the referral and/or the chaining backend?
Or could there be more?
The reason for this is to move the ACI chechk outside of LDBM into
do_<op>() but only for local backends.
The outside means pre- backend or
post- backend or both?
If ACI contains attribute value, how it'd be taken care of?
This way when we support multiple local backend types (which we do
already with fedse etc), instead of each backend suppling the need to
call acl's, we can do it once in the do_<op> at the correct step.
We don't need this for remote backends as we can not guarantee we parse
the ACI and that adds extra complexity to the situation. We assume the
remote backend does the ACI check for us via some kind of passthrough
bind, or other means.
Additionally, this flag would allow other plugins to distinguish if they
should operate or not on the operation - We may not want to apply
memberof to a remote BE for example.
_______________________________________________
389-devel mailing list -- 389-devel(a)lists.fedoraproject.org
To unsubscribe send an email to 389-devel-leave(a)lists.fedoraproject.org