10.4.8 Server, AFP and ACLs

Question

Hello all!
Before escalating I would like to have others take a look a this and confirm.
Setup:
- 10.4.8 Server, OD-master
- AFP Share: "Test"
- Usergroup: standard
AFP-Share "Test":
- Posix: ralph:standard, 644
- ACE: 0: group:standard allow list,addfile,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr, writeextattr,readsecurity,writesecurity,chown,file_inherit,directoryinherit (ie allow all)
- create Testfile in share:
anotheruser@server:/Volumes/Storage/Test$ touch testfile
anotheruser@server:/Volumes/Storage/Test$ ls -ale testfile
-rw-r--r-- + 1 anotheruser standard 0 31 Okt 11:20 testfile
0: group:standard inherited allow read,write,execute,delete,append,readattr,writeattr,readextattr,writeextattr,re adsecurity,writesecurity,chown
Ok, here we go:
a) chown testfile for a user of the group standard will succeed when ssh'ed to the server
b) chown testfile fails when working on a client computer that is bound to OD and mounts the share via afp.
a)
testuser@client-comp$ ssh server
testuser@server$ chown testuser:standard /Volumes/Storage/Test/testfile
testuser@server$ ls -al /Volumes/Storage/Test/testfile
-rw-r--r-- + 1 testuser standard 0 31 Okt 11:20 testfile
b)
Computer bound to OD:
- 10.4.8
- testuser is a true OD user, not a local user
- log into client computer as testuser
- mount share via afp with testusers credentials
testuser@client-comp:~$ cd /Volumes/Test
testuser@client-comp:/Volumes/Test$ ls -ale testfile
-rw-r--r-- + 1 anotheruser standard 0 31 Okt 11:20 testfile
0: group:standard inherited allow read,write,execute,delete,append,readattr,writeattr,readextattr,writeextattr,re adsecurity,writesecurity,chown
testuser@client-comp:/Volumes/Test$ chown testuser:standard testfile
Permission denied
testuser@client-comp:/Volumes/Test$
Ooops!!!!!
This breaks saving in Freehand MX of opened and edited documents that you want to save and replace (Command-S).
Awaiting thoughts/confirmation before filing bug report.
-Ralph

Answer 1

I've experienced the same problem. My users can chown by ssh'ing to AFP server of file in question but can't in Terminal perform chown on same file logged in to localhost by default.
This subverts ACLs' usefulness in at least the respect that allowing group members to change ownership of files served in accordance with AFP is rendered unduly complex. One might as well not try that setting--for most clients, anyway.
Moreover, my take is that this is no small matter. I've posted more here. http://discussions.apple.com/thread.jspa?threadID=831517
In this thread, though, can anyone comment on this or suggest how my users can invoke their ACL permission as members of a certain group to chown files on AFP shares in a local shell or--imagine this--in the "Get Info" interface?
PS In my search for a workaround, I posted under the topic "Command Line & Terminal":
http://discussions.apple.com/thread.jspa?threadID=830698&tstart=0
PPS Maybe this is an old problem. See this 2004 posting about "a bug lingering somewhere in the afp client code".
http://discussions.apple.com/thread.jspa?messageID=3855261&#3855261
PowerMac   Mac OS X (10.4.8)