On 05/31/2011 03:19 PM, Bryan Kearney wrote:
On 05/27/2011 03:13 PM, John R. Dunning wrote:
> Goodness. You go to a few meetings, and the next thing you know,
> there's a gigantic pile of email waiting.
>
> I have not read in detail all the previous replies. I'll do that.
> And I haven't finished thinking through the issue in sufficient
> detail, or talking technical guts with Jim and Pete, to have a fully
> formulated idea. I'll do that too.
>
> But meantime, I thought it would be worth saying a bit about the path
> I've been going down to come up with a solution for this.
>
> Rough metaphor: each obj in iwhd has perms roughly similar to *nix fs
> perms, with a hierarchy of r/w/x bits. Where 'x' is really launch.
>
> All the perm values are represented in MD tags on the object.
>
> "Somebody" defines what a user id is. Could be a string like
"jrd" or
> a wacky uuid or whatever. From iwhd's point of view, it's a string
> token. I'm not expecting to do any any checking of the token, ie go
> look it up in ldap or anything.
>
> One of the use cases is to give specific perms to specific users. So
> there's a tag for each user, storing perm bits. The tag is probably
> implemented as a fixed prefix against the user id, something like
> "user-permission-<user-id>". Objects with only a single user perm
are
> effectively owned by that user. [NB that this means that there isn't
> a single owner, essentially all users which have write access are
> owners]
>
> One of the use cases is to give object access to a group. Similar to
> user, there's a group tag, something like
> "group-permission-<group-id>". [NB that I'm assuming these group
tags
> are stored on the objects, not on users. If we adopted a user model
> where a user had its own group properties, this could be simplified]
>
Can an object have more than one group tag?
It would need to from what I understand.