[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: ldapbis WG Last Call on ldapbis-syntaxes, ldapbis-strprep

At 11:54 PM 6/25/2003, Hallvard B Furuseth wrote:
>>> If I understand you correctly, the part of [Models] 2.3 which I
>>> quoted should be changed to something like
>>>
>>>  If the attribute type has an equality matching rule, any two values
>>>  of the attribute must compare as false according to that matching
>>>  rule.
>>
>> Yes.
>
>In view of this, I'm beginning to dislike that Prohibit step.
>If I have a purely local LDAP directory, why shouldn't I be allowed to
>give an attribute two values where one uses a Private Use code point?

These rules are designed for interoperability between independently
developed implementations which you are likely to have even in
local environments.  If all directory agents do not agree on matching
rule semantics, interoperability problems will occur.  Some of these
will have impact upon security.  These matching rules are not just used
by DSAs to locate information, but used in DUAs to correlate information
provided by the DSAs.  To be appropriate for naming of objects and
values of security related attributes, I think the appearance of a
Private Use code points in strings to be matched with these rules
need to cause the evaluation to be Undefined.

Note that one is always free to define other schema elements to meet
local needs.

Kurt