[SSSD] Proposed changes to the HBAC grammar

Sumit Bose sbose at redhat.com
Wed Nov 17 21:48:15 UTC 2010


On Wed, Nov 17, 2010 at 04:07:24PM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> During a discussion today about how to represent the HBAC grammar in the
> FreeIPA GUI, it became apparent that there was a limitation in the
> grammar. Specifically, it's not possible to describe in a non-ambiguous
> way "The first Wednesday of the month".
> 
> Right now, this would be described by:
> accessTime: periodic monthly week 1 day 3 0800-1700
> 
> However, this literally means "Wednesdays that appear as the first week
> on a wall calendar". Meaning that if the month began on a Thursday, this
> rule would not fire this month. Thus it's not behaving in a way that
> would be reasonably expected by a user.
> 
> After extended discussion, Simo, Ben and I discussed replacing this
> week-of-the-month concept with a septet-of-the-month concept instead.
> 
> This would be described by:
> accessTime: periodic monthly septet 1 day 3 0800-1700
> 
> and would literally translate as "The wednesday that exists within the
> first septet of the month". The first septet being the range of day 1
> through day 7, the second septet being day 8 through 14, and so forth.

I would like to suggest to allow negative numbers to cover 'the last
Wednesdays of the month'.

bye,
Sumit

> 
> We all feel that this would map closer to a user's expectation when
> describing "the Nth Wednesday of the month", since it's a guarantee that
> Wednesday will appear only once within a septet.
> 
> This will require two changes to the HBAC schema. First of all, we plan
> to drop the week-of-the-month concept entirely and replace it with
> septet-of-the-month. This is being done to eliminate the ambiguity
> entirely. Secondly, we will need to describe day-of-the-septet in the
> grammar (where the day of the septet describes the name of the weekday,
> and not its numerical position within the septet, as that would be a
> useless and complex duplication of the day-of-the-month concept).
> 
> 
> In a related note, we also discussed how to handle describing activity
> windows that cross the midnight boundary. It's my recommendation that we
> should handle examples like the following by breaking them into two
> separate accessTime attributes, one that describes the portion preceding
> midnight and describes the set of days wherein the block starts, and a
> second accessTime attribute that is offset by one day and describes the
> portion taking place after midnight.
> 
> Second-shift (17:00-01:59, M-S*) *starts Monday, ends Saturday morning
> becomes
> accessTime: periodic weekly day 1-5 1700-2359
> accessTime: periodic weekly day 2-6 0000-0159
> 
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAkzkRAwACgkQeiVVYja6o6NtHwCgi3Vk2Q2aZXKIRHM3fbWOsLHE
> X6UAn3zECofcDzG1+gJClyUlDVZvKnmS
> =+zfc
> -----END PGP SIGNATURE-----
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list