13.0.1 Prior Approaches

Before WebDAV ACLs were standardized, WebDAV servers had various approaches to setting ACLs on resources. For example, Xythos WebFile Server has a server-hosted, Web-based GUI so that users can change their own resource ACLs using a Web browser. Microsoft IIS 5.0 allows remote Web authors to change ACLs using SMB (the local file-sharing protocol), which restricts non-Windows users from managing permissions. Exchange 2000 used a WebDAV property to allow all users to read and write the ACL for a mailbox, calendar, or resource, but only Windows-based software could easily parse the format of the property value.

If all WebDAV servers had a Web-based GUI for setting access control, one could imagine declaring that the standard. The only thing client software would need is some way to know the link to the Web-based GUI, display that GUI to the user, and allow the user to change ACLs that way. With this approach, the server could present any list of privileges, any model for access control, and any interface it chose. This is the "dumb client," or thin client model.

The thin client model already exists in Web-based user interfaces and can hardly be called a standard. It is unacceptable to implementors of rich clients. Rich clients need control over the presentation to have a consistent and usable user interface. The thin client model is also extremely unwieldy for handling bulk changes. The WebDAV Working Group knew of these problems and started working on standardizing ACLs even before the WebDAV RFC was published.

WebDAV ACLs are designed to be roughly compatible with NFS version 4 [RFC3010] and Windows NT File System (NTFS) access controls. A server implementation ought to be able to store files and set permissions directly in any NTFS or NFS-compatible file system and expose this system interoperably over WebDAV.