Subject: Re: RFC 3744: deny-before-grant required?

From: Julian Reschke <[email-masked]>
Date: Sat, 01 Jul 2006 10:13:27 +0200

Tim Olsen schrieb:
> 
> Section 8.1.1 
> (http://greenbytes.de/tech/webdav/rfc3744.html#acl.preconditions)
> of RFC 3744 specifies that deny-before-grant is a requirement.  It
> does not follow this with a condition stating that it only applies if
> the constraint is set, as is done for grant-only and no-invert.
> 
> Is this omission of a condition under which this preconditon holds
> intentional?  Is deny-before-grant a requirement?

I don't think it is, that is, I think you have found a bug in the spec.

So I would propose to change the description to:

"(DAV:deny-before-grant): All non-inherited deny ACEs MUST precede all 
non-inherited grant ACEs. This precondition applies only when the ACL 
restrictions of the resource include the DAV:deny-before-grant 
constraint (defined in Section 5.6.3)."

(Geoff, please confirm :-))

Best regards, Julian

---

From: Geoffrey M Clemm <[email-masked]>
Date: Sat, 1 Jul 2006 13:06:55 -0400

Yes, that looks like a bug to me as well, and I would fix it as Julian
suggests.
Cheers,
Geoff

---

From: Julian Reschke <[email-masked]>
Date: Tue, 04 Jul 2006 14:33:44 +0200

> Yes, that looks like a bug to me as well, and I would fix it as Julian

OK, fixed with 
<http://greenbytes.de/tech/webdav/draft-reschke-rfc3744bis-latest.html#rfc.issue.8.1.1_deny_before_grant-precondition>.

Best regards, Julian