Re: Adding a non-inheritable permission to a folder using webdav clie nt lib not working

[James Mason <ma...@apache.org>]

Krishna,

As far as I know Slide always sets permissions on collections to
inheritable.

-James

On Mon, 2004-10-25 at 16:49 -0400, Krishna Kankipati wrote:
> Hi,
> 	I have been trying for quiet some time to add a permission to a
> folder using webdav client-lib that does not inherit to the downstream
> folders. I have taken the code from client-lib that is shipped with slide
> and am using slide 2.1 B1. In my code I use the following fragment to create
> an ACE object and bind it to ACL. 
> 
> The code works perfectly if 4th parameter (isInherited) is set to false
> 
> // Create new ACE object bIsInherited = false
> aceNew = new Ace(sPrincipal, bDenyPrivilege, false, bIsInherited, null);
> 
> 
> The code does not work if 4th parameter (isInherited) is set to true. I am
> assuming that you set the 4th parameter to true if you are trying to make
> the permission non-inheritable (not allow it to percolate to the downstream
> folders).
> 
> With 4th parameter set to true, webdav client does not throw any error but
> does not add the permission. Later when I get the ACL for the resource I
> find that the ace has not been added.
> 
> Please let me know if I am missing something ... or if it is possible at all
> to create a permission(ace) in a ACL which does not percolate to downstream
> folders using webdav client lib.
> 
> I found that adding a inheritable(false) permission in domain.xml does the
> job as desired. I am wondering why it is not working from webdav client lib.
> 
> Any help is appreciated !!!!!!
> 
> /******************* code fragment *****************************/
> 
> // Fetch ACL from slide for a folder
> AclProperty acl = webDavResource.aclfindMethod(sResourcePath);
> 
> // Fetch the ACE's (access control entities) of the existing ACL
> Ace[] aces = acl.getAces();
> 
> // Create new ACE object none exists
> if (aces == null)
>    aces = new Ace[0];
> 
> Ace[] oldAces = aces;
> // Create a new ace array (larger then the earlier ace array by 1)
> aces = new Ace[oldAces.length + 1];
> 
> // Copy the old array into the new array
> System.arraycopy(oldAces,0,aces,0,oldAces.length);
> 
> // Create new ACE object bIsInherited = true
> aceNew = new Ace(sPrincipal, bDenyPrivilege, false, bIsInherited, null);
> 
> // Copy the new ace into the new ace array
> aces[oldAces.length] = aceMatchingPrincipal;
> 
> // Create a new privilege
> Privilege privilegeNew = new Privilege(qnPermission.getNamespaceURI(),
> qnPermission.getLocalName(), null);
> 
> // Update the ace object with the new privilege settings
> 
> aceNew.addPrivilege(privilegeNew);
> 	
> // Update repository with new acl for the resource
> bSuccess = webDavResource.aclMethod(sResourcePath, aces);
> 
> 
> 
> Krishna
> (303) 274 3027


---------------------------------------------------------------------
To unsubscribe, e-mail: slide-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: slide-user-help@jakarta.apache.org

Re: Adding a non-inheritable permission to a folder using webdav clie nt lib not working

[Michael Smith <ms...@speedlegal.com>]

James Mason wrote:
> Krishna,
> 
> As far as I know Slide always sets permissions on collections to
> inheritable.
> 
> -James

Right. The webdav ACL protocol has a strange asymmetry here: it can tell 
you whether a permission is inheritable or not, but it has no way to 
specify that (either way) when _setting_ an ACL (whether the ACEs set 
are inheritable or not is implementation defined).

This is particularly troubling since you have to set all the ACEs at 
once, you can't just add/remove/modify one at a time. So this means that 
  you may be unable to preserve the meaning of existing ACEs when adding 
a new one.

Mike


---------------------------------------------------------------------
To unsubscribe, e-mail: slide-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: slide-user-help@jakarta.apache.org