On Wed, 2018-01-10 at 10:44 +0100, Ludwig Krispenz wrote: > On 01/10/2018 07:03 AM, William Brown wrote: > > If I have: > > > > (targetattr=x)(version 3.0; .... allow(read, > > search)(groupdn=cn=x);) > > > > If cn=x has member cn=y, and cn=y member uid=z > > > > Does uid=z have permission to the targetattr here? IE do our aci's > > work > > through nested groups? > > yes, they should, but there is configurable max nesting level Great! Thanks for clarifying this :) Perhaps something we could look at is aci's resolving membership of an entry via it's memberOf attributes if memberOf is enabled? That would allow quicker resolution of nested groups I would think .... > > > > > > -- > Red Hat GmbH, http://www.de.redhat.com/, Registered seat: Grasbrunn, > Commercial register: Amtsgericht Muenchen, HRB 153243, > Managing Directors: Charles Cachera, Michael Cunningham, Michael > O'Neill, Eric Shander > _______________________________________________ > 389-devel mailing list -- 389-devel@xxxxxxxxxxxxxxxxxxxxxxx > To unsubscribe send an email to 389-devel-leave@lists.fedoraproject.o > rg -- Sincerely, William Brown Software Engineer Red Hat, Australia/Brisbane _______________________________________________ 389-devel mailing list -- 389-devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
