Re: (ITS#4989) Quirk in Dynlist overlay configuration

[kurt@OpenLDAP.org]

On Jun 2, 2007, at 2:47 PM, marg@rz.tu-clausthal.de wrote:

> Hello...
>
> ando@sys-net.it wrote:
>> marg@rz.tu-clausthal.de wrote:
>>
>>> I found a behaviour issue with the dynlist overlay configuration:
>>>
>>> I tried the following configuration:
>>>
>>> overlay dynlist
>>> dynlist-attrset posixGroup memberURL
>>> dynlist-attrset groupOfURLs memberURL owner
>>
>> The reason of that check is that the same attribute "memberURL" could
>> otherwise be used by both group classes to expand.
>
> [...]
>
>> However, I believe something like
>>
>> dynlist-attrset posixGroup memberURL
>> dynlist-attrset groupOfURLs memberURL
>>
>> should still be forbiden, otherwise the same "memberURL" would expand
>> twice.  This, strictly speaking, is not an issue, as duplicates would
>> simply be discarded, but it would cause unnecessary overhead.  Right
>> now, I have decided to turn this check into a config-time warning.
>
> Hmm - I object.
>
> posixGroup and groupOfURLs are both "structural" objectclasses so an
> entry is either a "groupofURL" or a "posixGroup", never both.

Yes, but an entry can belong to both.  That is, an entry's structural
class could inherit from both of these classes.

> And in
> this case the memberURL can have different meanings according to the
> Objectclass it is used in.

That's called bad schema design.  If an attribute has is specified
to have different meaning when used with X then when used with Y,  
it's not
only unclear what meaning the attribute as when used with both X and
Y, but also used without either X or Y.  Note that attributes may be
added to an entry which are not allowed by any of the classes the
entry belongs to...  (see DIT content rules).

> Otherwise I'd have to create an Attribute for every expansion I  
> want to
> use - that can't be right!
>
> You are right for expansions in auxillary OCs, of course! They  
> shouldn't
> be using the same attribute...
>
>> Please test and report.
>
> Will do, sometime soon.
>
> bye
> Christian
> -- 
> Christian Marg                    mail: mailto:marg@rz.tu-clausthal.de
> Rechenzentrum TU Clausthal        web : http://www.rz.tu-clausthal.de
> D-38678 Clausthal-Zellerfeld      fon : 05323/72-2043
> Germany                           ICQ : <on request>
>
>