Re: [Fwd: Re: Paged Results and limits]

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 08:31 AM 4/15/2004, Kurt D. Zeilenga wrote:
>Then, access controls would get a new what AND who parameter
>called "when".  A contrived example:
>
>        limit dn=xxx when=(o-c-pagedresults=TRUE) size.hard=N
>
>or with access controls:
>        access to * when=(o-c-pagedresults=TRUE)
>                by * when=(o-c-manageDSAit=TRUE) read 

Taking this a bit (actually, a lot) further... consider a
limit as just another property.  Say, for instance,
search-candidate-limit.  We could administrate this with
something like.

        set search-candidate-limit on connection to 1000
        set search-candidate-limit on authentication
                        by dn=xxxx to unlimited
                        by users to 2000
                        (implicit by * to current)
        set search-candidate-limit
                on operation=search control=pagedresults
                        by users to 4000
                        by anonymous to 0
                        (implicit by * to current)

Now, the language gets interesting when you allow condition
on clauses in the set language...

        set search-candidate-limit on operation-processing
                when=(o-c-pagedresults=TRUE)
                        by users to 4000
                        by anonymous to 0
                        (implicit by * to current)

and really interesting when you start allow admin defined
properties.
        define boolean superuser on authentication
                by dn=xxxx to TRUE

and allow that in set statements:
        set search-candidate-limit on operation-processing
                when=(superuser=TRUE)
                        by * to unlimited

Kurt