I was recently asked to implement/research using a local cascaded addressbook with database security using groups and Enforce consistent ACL.

My gut feel was that it would not work, but, I've I've been surprised by that kind of thing before, so, I took a look.

To my surprise, simply adding groups to the local addressbook allowed for group based authentication (boom! I have manager access to my replica of your database), since the local addressbook needs to have its security wide open security, it turns this technique from a security setting, to a faux security technique, and absurdly easy to overcome.

When I added a second addressbook to the mix the groups were not read or respected at all from the second addressbook.

1. Brian Mumey01/12/2006 12:30:09 PM

Hey Dwight! I think misunderstanding this post. I have a local replica which uses 'enforce consistent acl'. It has a group with manager access. I add a group of that name to my local address book with me listed as a member. This will give me manager access to the replica? It didn't for me, but maybe I'm doing something wrong.