Re: access control and non-default contexts

2006-09-05 Thread Thomas Anders
Wes Hardaker wrote: > DS> I'm inclined to leave things as they stand - this feels a more secure > DS> arrangement, and is probably in line with default expectations. > I actually think it should authorize all by default. That's what it's > done before and it's a behavior change. I'm on the fenc

Re: access control and non-default contexts

2006-09-05 Thread Wes Hardaker
> "DS" == Dave Shield <[EMAIL PROTECTED]> writes: DS> I'm inclined to leave things as they stand - this feels a more secure DS> arrangement, and is probably in line with default expectations. But DS> it does result in a minor change in behaviour, so I wouldn't object if DS> the consensus was

Re: access control and non-default contexts

2006-09-05 Thread Dave Shield
On 05/09/06, Robert Story <[EMAIL PROTECTED]> wrote: > So long as we're talking 5.4+, Yup. > and there is a way for the user to > specify > something to get the old behaviour (i.e. a prefix context match on ""), Yup. (That's the tweak I had to make to the te

Re: access control and non-default contexts

2006-09-05 Thread Robert Story
On Tue, 5 Sep 2006 14:03:20 +0100 Dave wrote: DS> It turns out that this change has also affected the default behaviour DS> slightly. Up to now, these convenience directives have registered an DS> entry in the vacmAccessTable with a prefix context match on "" - thus DS> matching *ALL* contexts by

Re: access control and non-default contexts

2006-09-05 Thread Thomas Anders
Dave Shield wrote: > It turns out that this change has also affected the default behaviour > slightly. Up to now, these convenience directives have registered an > entry in the vacmAccessTable with a prefix context match on "" - thus > matching *ALL* contexts by default. Following my latest patc

access control and non-default contexts

2006-09-05 Thread Dave Shield
I've recently made an update to the processing of the access control directives, to support setting an explicit context (or context prefix). This has always been available via "access" (and "authaccess"), but I wanted to add similar functionality to the convenience routines (authcommunity, authuse