The securityDescriptor attribute, “defines
user accounts who may edit this range without providing a password to access the range”. It is a string. But no information is given as to what user accounts are referred to here, or what the delimiter is. Are these comma-delimited local machine user accounts Or semi-colon delimited LDAP DN’s There will be no interoperability if this is not defined.

Define how the accounts are delimited to ensure interoperability

- Part 4, Section 3.3.1.69

te

Proposed Disposition of DIS 29500 Comment DE-0091 (Modified: 2008-01-13) Agreed; the format of the securityDescriptor attribute is not well defined. The following changes will be made to Part 4, §3.3.1.69, page 2,004, row for the attribute securityDescriptor: Attributes Description securityDescriptor (Security Descriptor) Optional setting to specify the relative security descriptor. The security descriptor defines user accounts who may edit this range without providing a password to access the range. Removing this attribute shall remove all permissions granted or denied to users for this range. The format of a securityDescriptor is application defined; however, it is recommended that the following format be used for interoperability between implementations: username@domain If multiple user accounts are specified in the securityDescriptor attribute, each account shall be delimited by parentheses. [Example: This example demonstrates two user accounts in the security descriptor attribute: <protectedRanges> <protectedRange sqref="A1:C5" name="Range1" securityDescriptor="(user1@iso.org)(user2@iso.org)"/> </protectedRanges> end example] If an application is unable to resolve the meaning of the securityDescriptor, it shall treat the attribute as if it had been removed. The possible values for this attribute are defined by the XML Schema string datatype. Similar Comments: BR-0043 , CA-0041 , CL-0201 , CO-0150 , FR-0346 , GB-0299 , GR-0081 , KE-0060 , PT-0097 , US-0143 , VE-0059