Viewing Software Enhancements/5500
Full headers

Major security issue: yes  no

Notes:

Notification:

Date: Wed, 7 May 2008 18:52:26 GMT
From: h.b.furuseth@usit.uio.no
To: openldap-its@OpenLDAP.org
Subject: comments in cn=config entries

Full_Name: Hallvard B Furuseth
Version: HEAD
OS: 
URL: 
Submission from: (NULL) (129.240.6.233)
Submitted by: hallvard


One problem with back-config is that comments in slapd.conf
are lost when converting to cn=config, and cn=config does
not offer attributes in which to put comments.  So I suggest:

Add something like 'MAY ( description $ info )' to object class
olcConfig, and slapd.conf keywords with the same name.  description
to describe the slapd entry, info for other notes about it.

The slapd.conf keywords would allow admins to "upgrade" most comments in
slapd.conf before converting to cn=config.  They'll need to insert any
context into the comments though, and preferably move frontend directives
with comments in slapd.conf to an explicit frontend database.

I think it'd be best if these attribute names do not have a prefix
like "olc", so they'll stand out a bit from the rest.  Thus the
suggestion to stick to preexisting RFCed attributes.  However the
attribute for general notes ('info') should probably be treated as
X-ORDERED 'VALUES', I haven't checked if it's inconvenient to do
that with a preexisting attribute without that feature. The valsort
overlay does, but I don' suggest to require valsort.

Followup 1

Date: Wed, 07 May 2008 15:05:31 -0700
From: Howard Chu <hyc@symas.com>
To: h.b.furuseth@usit.uio.no
CC: openldap-its@openldap.org
Subject: Re: (ITS#5500) comments in cn=config entries

h.b.furuseth@usit.uio.no wrote:

> One problem with back-config is that comments in slapd.conf
> are lost when converting to cn=config, and cn=config does
> not offer attributes in which to put comments.  So I suggest:
>
> Add something like 'MAY ( description $ info )' to object class
> olcConfig, and slapd.conf keywords with the same name.  description
> to describe the slapd entry, info for other notes about it.
>
> The slapd.conf keywords would allow admins to "upgrade" most comments in
> slapd.conf before converting to cn=config.  They'll need to insert any
> context into the comments though, and preferably move frontend directives
> with comments in slapd.conf to an explicit frontend database.
>
> I think it'd be best if these attribute names do not have a prefix
> like "olc", so they'll stand out a bit from the rest.  Thus the
> suggestion to stick to preexisting RFCed attributes.  However the
> attribute for general notes ('info') should probably be treated as
> X-ORDERED 'VALUES', I haven't checked if it's inconvenient to do
> that with a preexisting attribute without that feature. The valsort
> overlay does, but I don' suggest to require valsort.

The X-ORDERED flag obviously cannot be added to existing schema elements; you 
need to define a new attribute.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

Followup 2

From: Hallvard B Furuseth <h.b.furuseth@usit.uio.no>
Date: Fri, 9 May 2008 10:31:29 +0200
To: hyc@symas.com
Cc: openldap-its@openldap.org
Subject: Re: (ITS#5500) comments in cn=config entries

hyc@symas.com writes:
>h.b.furuseth@usit.uio.no wrote:
>> However the attribute for general notes ('info') should probably be
>> treated as X-ORDERED 'VALUES', I haven't checked if it's inconvenient
>> to do that with a preexisting attribute without that feature. The
>> valsort overlay does, but I don' suggest to require valsort.
>
> The X-ORDERED flag obviously cannot be added to existing schema
> elements;

That's why I said "treated as" X-ORDERED (when occurring in cn=config).
If that's too cumbersome though:

> you need to define a new attribute.

An attribute private to OpenLDAP should have a prefix like "olc",
but an RFCed attribute must wait till (X-)ORDERED is standardized.

I suggest "olc-note", then.  Still stands out from the rest since the
others do not use hyphens, and also sorts it before the other "olc"s.

-- 
Hallvard