Re: PROPFIND Depth:1 and ACLs

That is true. You have to join with the ACEs granting or
denying the "read", "read-acl", "read-current-user-privilege-set"
and "all" privileges. The result set should then be matched
with the current user. This can't be part of the same join,
because of group memberships.

Note that the original result set you fetch from the database,
i.e. without ACEs, should be multiplied by the average number
of occurrences of the above-mentioned privileges per ACL. This
will depend on how well the user organises principals in groups.

Werner.

Tim Olsen wrote:
> 
> On 5/15/07, Werner Donné <[email protected]> wrote:
>> Indeed, because as soon as one property is also returned an ACL check is
>> required for each member, which is expensive if the collection has a lot
>> of members, say a few thousand.
>>
> 
> If you're using a SQL database, you can optimize this with a proper
> SQL query.  Just JOIN all the children of a collection against the acl
> check you normally do.
> 
> -Tim
> 
> 

-- 
Werner Donné  --  Re
Engelbeekstraat 8
B-3300 Tienen
tel: (+32) 486 425803	e-mail: [email protected]