Re: about frequently used ACLs

["Pierangelo Masarati" <ando@sys-net.it>]

>
> dn.{onelevel,subtree,children},ava[,multivalued] \
>         =<attr>;<pattern>

The ";" between <attr> and <pattern>
is ambiguous, although attribute options
are explicitly forbidden in RDN AVAs.
A "%" or a "/" could be used instead.

If implemented via ldap_bv2rdn(),
this could also avoid ambiguous,
although pathological, cases,
where a

dn.regex="commonName=[^,]+,dc=example,dc=com" (1)

would not match a DN like

"commonName=Foo,dc=example,dc=com" (2)

because dnNormalize() on (2) before regexec
with (1) would turn (1) into

"cn=Foo,dc=example,dc=com" (3)

Subtyping could be allowed as well,
possibly by means of a further modifier.

Ando.

-- 
Pierangelo Masarati
mailto:pierangelo.masarati@sys-net.it