Re: Returning single values from multivalued attributes

[Sean Mullan <sean.mullan@Sun.COM>]

Mark C Smith wrote:
> 
> David Chadwick wrote:
> >
> > This topic has been briefly discussed on this list before (30 July),
> > but no conclusions were reached. Briefly the situation is that X.500
> > DAP allows a user to search an entry and only request that matched
> > values are returned from a multi-valued attribute rather than all
> > attributes. LDAP only allows all or no values to be returned.
> >
> > There has also been a request in the PKIX group that LDAP should
> > allow a single user certificate to be returned (the one that matches
> > the users filter), rather than all the users certificates.
> 
> Is it a valid assumption that most entries will contain only a few
> certificates?  

A CA may store a potentially large number of cross certificates 
issued to or from other CAs. When building certification paths, it is 
useful to be able to search for a subset of certificates which satisfy
policy and name constraints, validity and other parameters required
for validating the certification path.

I can imagine an end-entity may also store many certificates, issued
by different CAs with different key usages and policies or certifying different
application specific identities. Searching for another user's S/MIME
certificate would involve constructing a certificate matching rule which
matched on the user's email address in the SubjectAltName component and minimally
an encryption bit in the keyUsage component. A rule such as this, when
combined with a matchedValuesOnly control could prevent the client from
downloading a large number of irrelevant certificates. 

> If so, the value of returning only the one that is
> matched is reduced.  Of course certificates are typically fairly large,
> so reducing the amount of data sent might be useful.  My guess is that
> reducing the number of network round trips is more important than
> reducing the data itself -- and a matchedValuesOnly control won't change
> help there.

I believe the matchedValuesOnly control could be abused if not used
wisely, especially if you have to perform multiple searches to find the
right value. But I think it is very valuable in certain scenarios
such as certificate searching and certification path building.

--Sean