Re: Deleting overlays from cn=config

[Michael Ströder <michael@stroeder.com>]

Howard Chu wrote:
> Hallvard B Furuseth wrote:
> > You also need to walk through the database and delete any attributes
> > object classes defined by the overlay.  That'll be at least any
> > operational attributes since they must be hardcoded into the C source.
>
> I wouldn't bother with that, since the schema definitions are still 
> present. Those attributes would simply stop being updated/generated...

Hmm, I'd consider this to be seriously flawed. It strikes me that there 
might still exist operational attributes in some entries which are no 
longer maintained by the DSA and there's no schema information available 
anymore.

Think of backup/restore situations where slapadd checks the schema...

> I think that's wrong. When you remove an overlay, you should expect to 
> lose all the functionality that the overlay provided.

Agreed.

> If the overlay had locked an account, the lock will simply disappear
> when the overlay is removed.

Which IMO means that also the attribute containing the lock (and all 
other attributes related to the removed overlay) should be removed.

Ciao, Michael.