Re: [glue-wg] DENY rules

Ciao Sergio,

please, have a look at section 18.3 of latest GLUE spec. There is an initial draft of how rules can be specified using a 'basic' policy scheme for GLUE:

basic rule ::= DN_RULE | VO_RULE | VOMS_RULE | ?ALL? DN_RULE ::= ?dn:? DN_NAME VO_RULE ::= ?vo:? [a-zA-Z0-9-_\.]* VOMS_RULE ::= ?voms:? VOMS_FQAN (?EXCEPT? VOMS_FQAN)?

How would one express that a VO "foo" has access except for the groups /foo/bar and /foo/xyz?