Subject: multistatus and BIND

From: "Tim Olsen" <[email-masked]>
Date: Mon, 2 Oct 2006 18:22:21 -0400

Hello,

Here is an example from the BIND draft.

┌──────────────────┐
│ Root Collection  │
│  bindings:       │
│  CollX           │
└──────────────────┘
   |
   |
   |
┌────────────────┐
│ Collection C1  │
│ bindings:      │
│ x.gif    y.gif │
└────────────────┘
   |         |
   |         |
 ┌─────────────┐
 │ Resource R1 │
 └─────────────┘

Let's say I do an infinite-depth copy on /CollX to /CollY, and I have read
permission on Collection C1, but not on Resource R1.  In my multistatus
response, do I have to specify a 401 for each URL for Resource R1
(/CollX/x.gif and /CollX/y.gif), or for just one of them?

thanks,
Tim

---

From: Geoffrey M Clemm <[email-masked]>
Date: Mon, 2 Oct 2006 23:08:51 -0400

You could do either, but I'd suggest a 401 for each URL, to not expose to 
the client the information that x.gif and y.gif refer to the same 
resource.

For example, suppose you had a collection with each of the nominees for a 
position, and a binding named "selected" to the one that was selected. But 
you didn't want to give anyone read access yet to see who was selected 
(but you wanted to let them see the collection, so they could see who was 
running).  If you returned only one of the bindings, and that was the 
binding to "selected", then someone who new who was nominated could figure 
out who was selected by seeing which name was omitted in the 401 report.

Cheers,
Geoff

> ┌──────────────────┐
> │ Root Collection  │
> │  bindings:       │
> │  CollX           │
> └──────────────────┘
>    | 
> 
>    | 
>    | 
> ┌────────────────┐ 
> │ Collection C1  │
> │ bindings:      │
> │ x.gif    y.gif │ 
> └────────────────┘
>    |         | 
>    |         | 
>  ┌─────────────┐ 
>  │ Resource R1 │
> 
>  └─────────────┘
> 
> Let's say I do an infinite-depth copy on /CollX to /CollY, and I 
> have read permission on Collection C1, but not on Resource R1.  In 
> my multistatus response, do I have to specify a 401 for each URL for
> Resource R1 (/CollX/x.gif and /CollX/y.gif), or for just one of them? 
> 
> thanks,
> Tim

---

From: Julian Reschke <[email-masked]>
Date: Tue, 03 Oct 2006 13:23:38 +0200

Tim Olsen schrieb:
> Let's say I do an infinite-depth copy on /CollX to /CollY, and I have 
> read permission on Collection C1, but not on Resource R1.  In my 
> multistatus response, do I have to specify a 401 for each URL for 

Independently of that question, it would be 403, right?

Best regards, Julian

---

From: "Charlie Smith" <[email-masked]>
Date: Tue, 03 Oct 2006 08:23:51 -0600

Suggested mail list for help with perldav please?

Charlie Smit

----------------------------------------------------------------------
NOTICE: This email message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

---

From: "Tim Olsen" <[email-masked]>
Date: Tue, 3 Oct 2006 10:47:30 -0400

> Independently of that question, it would be 403, right?

I'm not sure.  From HTTP/1.1 :

"If the request already included Authorization credentials, then the
401 response indicates that authorization has been refused for those
credentials."

Whereas for 403:

"Authorization will not help and the request SHOULD NOT be repeated."

So if you have the option of authenticating with different credentials
which may have the proper permissions, then I guess 401 is
appropriate?

thanks,
Tim

---

From: Julian Reschke <[email-masked]>
Date: Tue, 03 Oct 2006 18:13:44 +0200

> which may have the proper permissions, then I guess 401 is

Yes, it seems you are right. Of course that may be hard to detect on the 
server...