Re: ACLs based on attributes?

[Jaap Winius <jwinius@umrk.nl>]

Quoting Dieter Kluenter <dieter@dkluenter.de>:

> >    description: titlemanager telephonemanager addressmanager
>
> This is a single value, you actually want a multi valued attribute type.

Doh!

> Did you define an index for description? ...

No, but that sounds like a good idea.

Quoting Howard Chu <hyc@symas.com>:

> It is unnecessary. The description attribute is multivalued, just use
> it correctly.

Doh!

Okay, then the set rule is obviously fine the way it is.

> I'll also note that using a set for this purpose is still inferior
> to using a dynamic group, in terms of performance. Dynamic group
> evaluations are cached, sets are not.

If this "set" solution were to be used on a DIT with 100,000 entries,  
would it really slow things down significantly, assuming the  
description attribute was indexed?

Thanks,

Jaap