If the Permission is added to existing PermOUs, then any ARBAC roles pointing 
at that PermOU don't need updated.

----- Original Message -----
From: "Shawn McKinney" <smckin...@apache.org>
To: fortress@directory.apache.org
Sent: Wednesday, October 12, 2016 9:03:53 AM
Subject: Re: ARBAC Perm OU change proposal (was Access Manager Role Filtering)

> On Oct 12, 2016, at 7:52 AM, Chris Pike <clp...@psu.edu> wrote:
> To answer your question, a new permission would be in a new PermOU that no 
> existing ARBAC role could have jurisdiction over. So every relevant ARBAC 
> role would have to be updated.

Wouldn't that situation still occur regardless?  What about a multioccur ou 
that bypasses this problem?

Reply via email to