Re: [glue-wg] DENY rules

Maarten.Litmaath@cern.ch [mailto:Maarten.Litmaath@cern.ch] said:

How would one express that a VO "foo" has access except for the groups /foo/bar and /foo/xyz?

If you adopted this scheme you would have two rules: VOMS:/foo VOMS:/foo/*:EXCEPT:/foo/bar:EXCEPT:/foo/xyz Note that the EGEE matching rules specify that /foo only matches the top-level group (only the primary FQAN is considered), so you need both /foo and /foo/* to cover a whole VO. Stephen