Re: ActiveDirectory schema

[Mark Smith <mcs@netscape.com>]

David Boreham wrote:
> 
> "Kurt D. Zeilenga" wrote:
> 
> >No, but Netscape DS does:
> > objectclass top optional aci
> 
> Ouch ! Rob walked straight into that one !
> 
> Mind you, surely one aci attribute (for which there's
> a fairly good reason to add to "top") is less of
> a crime than a whole page of random attributes ?

It is still a crime though.  If I remember correctly, we added aci to
top in Netscape Directory Server because we did not yet have full
support for operational attribute types (something we are planning to
fix soon).  As Mark Wahl said, an operational attribute is the right
solution for something like access control information.

-- 
Mark Smith
Netscape Communications Corp. / Directory Server Engineering
"Got LDAP?"