mailing list archives

If a user has rights that "will always be granted" on a mailbox (e.g. that show up in the first rights set in a LISTRIGHTS untagged response), is that user/rights pair to be listed in the GETACL response on that mailbox?

   The GETACL command returns the access control list for mailbox in an
   untagged ACL response.

   The LISTRIGHTS response occurs as a result of a LISTRIGHTS command.
   The first two strings are the mailbox name and identifier for which
   this rights list applies.  Following the identifier is a string
   containing the (possibly empty) set of rights the identifier will
   always be granted in the mailbox.

On Tue Apr 10 22:28:27 2007, Dan Karp wrote:
> If a user has rights that "will always be granted" on a mailbox 
> (e.g. that show up in the first rights set in a LISTRIGHTS untagged 
> response), is that user/rights pair to be listed in the GETACL 
> response on that mailbox?
> 
> 
In principle, that would be a reasonable reading of RFC4314, and you 
would not be non-compliant for doing so.

In practise, it might be silly under some circumstances.

The LISTRIGHTS response tells you two things - and note I'm 
deliberately using a different wording:

1) The groups of rights that may be granted to the identifier.

2) The set of inalienable rights the identifier implicitly has.

I'd personally say that you should examine *why* the identifiers have 
these implicit rights, and decide on that basis whether to include 
them in the ACL - and in some cases, whether to admit they have 
implicit rights in LISTRIGHTS.

I don't think you'd confuse clients by having a degree of discrepency 
between LISTRIGHTS and GETACL, but you might confuse clients by 
including entries in the ACL if they're not really needed. (For 
example, Thunderbird decides whether a mailbox is shared according to 
the contents of the ACL.)

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@jabber.org
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade

> > If a user has rights that "will always be granted" on a mailbox 
> > (e.g. that show up in the first rights set in a LISTRIGHTS untagged
> > response), is that user/rights pair to be listed in the GETACL 
> > response on that mailbox?
> 
> I don't think you'd confuse clients by having a degree of discrepency
> between LISTRIGHTS and GETACL, but you might confuse clients by 
> including entries in the ACL if they're not really needed. (For 
> example, Thunderbird decides whether a mailbox is shared according to
> the contents of the ACL.)

OK.  So a reasonable implementation might, say, fail to include the authenticated user's default rights on their own mailboxes?

On Wed Apr 11 16:04:45 2007, Dan Karp wrote:
> > > If a user has rights that "will always be granted" on a mailbox 
> > > (e.g. that show up in the first rights set in a LISTRIGHTS 
> untagged
> > > response), is that user/rights pair to be listed in the GETACL 
> > > response on that mailbox?
> > > I don't think you'd confuse clients by having a degree of 
> discrepency
> > between LISTRIGHTS and GETACL, but you might confuse clients by > 
> including entries in the ACL if they're not really needed. (For > 
> example, Thunderbird decides whether a mailbox is shared according 
> to
> > the contents of the ACL.)
> 
> OK.  So a reasonable implementation might, say, fail to include the 
> authenticated user's default rights on their own mailboxes?

Actually, you probably want to include that. I'd not be surprised if 
Thunderbird would get confused otherwise. It's other things you 
probably don't want to include, such as any rights that 
administrative users or system users have.

Arguably, you don't want those to be listed in LISTRIGHTS either.

Dave.
-- 
Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@jabber.org
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade