[CalendarServer-dev] Groups and membership

[Cyrus Daboo]

Hi Wilfredo,

--On September 8, 2008 10:52:35 AM -0700 Wilfredo Sánchez Vega 
<wsanchez at apple.com> wrote:

>    If we do this, we should be able to do all group membership checks
> via DS and without needing an in-memory cache.

Sounds reasonable. Some points:

1) As far as I recall DS itself does not have a "is X a member of Y" API 
call. Instead we have to use memberd. The PyAppleAuth module that the wiki 
uses has an API into memberd, though interesting they force memberd to 
reload its cache each time due to a purported bug. The question is whether 
memberd is doing anything different than what we are doing today? All we 
may end up doing is removing the complexity we have in favor of memberd - 
but then we depend on that to work properly.

2) For delegates the proper solution is to create the new "who am I a 
delagate for" report and cache that subset of the group memberships. That 
will solve the need for clients to do depth:infinity group resolutions of 
their own.

-- 
Cyrus Daboo