PHPGACL Handbook of Chinese Words (vii)

PHPGACL Chinese Handbook (vii)

Resolve Conflicts

What happens if we add Chewie to the team of engineers? default: Deny all
Millennium Falcon passenger
├- Crew [Allow: All]
│├─han
│├─chewie [ rejection: Engine compartment]
│└─Lando
├─ passengers [Allowed: Lounge]
│├─ Jedi Warrior . [Permissible: Cab]
││├─Obi-wan
││└─Luke [ allow: Weapons room]
│├─r2d2 [ allow: Engine compartment]
│└─C3PO
└- Engineer [allow: Engine room, weapons room]
├─Han
├─R2D2
├─hontook
└─Chewie

this will make Chewie access to the engine room has been ambiguous, as the tree traverses from the root to the Chewie there are two paths. If the spaceship's computer is along one of the paths (the crew path), it will get the conclusion "refuse to enter the engine room". And along the other path (the engineer's path) will be "allowed to enter the engine room" conclusion, then he has no right to enter the engine room?

when you add or edit multiple groups of ARO object makes it a ACO The permissions of the object are ambiguous, phpgacl The system warns you. But it will recent precedence to resolve conflicts.

If we ask now phpgacl "Chewie Do you have access to the engine room? "Then the result returned is recent acl modified content (This is phpgacl Policy). In the above example, the returned result is "allow" because the "Allow: Engine room, weapon room" permission specified by the engineer group is closer to the "Deny: Engine room" permission time specified by the crew group.

When ambiguous permission settings exist in the ACL list, the ACL list is called inconsistent . Inconsistent ACL lists are dangerous, and if you allow your ACL list to remain in this situation, you may inadvertently assign permissions to inappropriate people. When Phpgacl warns you that the ACL list is inconsistent, it is best to resolve the conflict to restore its consistency as much as possible.

In order to resolve the conflict of the above example, we can do any of the following steps:

• Delete in Crew group Chewie the "Reject: Engine room" directive
• Add in the engineer group Chewie the "Reject: Engine room" directive
• Delete in the engineer group Chewie , because Han It is worth considering that he is an engineer in any case.

Han The third option was chosen to Chewie Remove from group of engineers

