Re: ldapACI: collection and attribute list

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 07:42 AM 3/21/00 -0600, Ellen Stokes wrote:
>(EJS)  Kurt,  One possible solution to this (and I certainly haven't
>thought this all the way through, but building on your thoughts) might
>be to define a 'collection' class whose attribute is, for example, called
>'list' which contains a list of the attributes in that collection.  One could
>then subclass to define new collections, but this class would never be
>instantiated in the directory - I would view it as a 'meta' class or schema
>definition.  Is this what you had in mind?

I had in mind using instantiatable (and other) object classes.
I draw this suggestion from my longstanding desire to be able to
limit returned results by object class.  Lately, I've been thinking
of extending search attribute lists to accept things like:
	person;objectclass
	mailRecipient;objectclass

The presense of one of these attributes descriptions would cause
all attributes of the named object classes to be 'requested'.
The same mechanism could be applied to ACIs... the ACI would apply
to all attributes of the named object class.

As far as the 'collection' class idea, I would argue that we already
have such... 'auxiliary'.