Q: Access Control Options

[David Muir]

>     That's a sad humor. I'm even not sure it was funny.
>
>     I don't have your experience about SVN auth solutions, and
>     therefore I don't understand why built-in ACL support in the
>     bzr:// protocol would hurt. I would like to understand all issues
>     here. But as my naive expectation such thing like built-in ACL and
>     simple users management will be so easy to use for people so
>     everybody would love to use only the fastest bzr:// protocol
>     because it would be so easy to set it up.
>
>     For example, there is still no bzr+ssh:// support on Savannah,
>     only sftp. Why? Maybe because bzr+ssh:// is a bit harder to setup?
>
>     My personal interest in easy and built-in ACLs is to allow even
>     the smallest company to setup bzr:// server on any spare computer.
>     In such small companies there is no certified sysadmins at all,
>     and people maintain their infrastructure themselves. I'm dreaming
>     about: just install, configure (possible via qt-based wizard ;)
>     and go!
>
>
>  
> Alexander, I think you understand the need perfectly.  (Ok, perfectly 
> for me, maybe not perfectly for everyone else.)  The concerns I have 
> about access control layers and tools is that the ones I have seen 
> have been built with an implicit assumption (or inflicted requirement) 
> that the organization has a full-time configuration control engineer.  
> That's a bad assumption, and I don;t think it should be necessary.  My 
> most unfavorite example is ClearCase.  Admittedly, this is an extreme 
> example.  The whole ClearCase system projects a bureaucratic and 
> authoritarian culture.  And this flows down into every aspect, 
> including access control tools which are a real pain to learn and use 
> effectively, given the simplicity of the goals.
>  
> To be clear, I do not think baked-in ACL has to be bad for bzr.  It 
> could be very good, provided it is done by people who really 
> understand the security requirements in a way which respects the 
> simple-things-should-be-easy culture of bzr.  So I've been 
> experimenting with ways to get the results I need with existing tools 
> rather than push for a feature request that I haven't fully figured 
> out myself.  If someone wants to take a stab at it, great!
>  
> ~M
>  

Maybe it would simply be better to have the acl part of it run 
separately from bzr? Essentially, instead of connecting to a bzr 
smart-server, you'd connect to the bzr acl-server, which would delegate 
out to the relevant bzr smart-server if allowed. No idea what would be 
involved though.

Out of curiosity, what are the existing tools you've been experimenting 
with?

David






-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ubuntu.com/archives/bazaar/attachments/20101001/522f041b/attachment.htm