Re: DBIS - new IETF drafts

On 08/01/2014 18:57, Michael Ströder wrote:
> Arthur de Jong wrote:
>> I personally like the use of flat names to describe group membership. It
>> makes the semantics much simpler than dealing with things like the
>> member or uniqueMember attribute (at least from a client implementation
>> perspective).
>>
>> The use of distinguished names may seem more logical from an LDAP
>> structure point of view, but you will have to dereference any DN to a
>> user name for building up a group entry resulting in potentially a lot
>> of search operations to get complete data.
> Using DNs allows to implement server-side access control. I'm not a friend of
> letting client-side demons enforce the access control because if a machine got
> hacked the attacker can find out more about the infrastructure.
>
> Ciao, Michael.
>

Hi Michael,

Please will you give me a more solid example of what you are referring 
to re access control?  What is it exactly you think you'd like to do 
with regards to group membership and server-side access control?

Thanks,
Mark.