Re: Dereferencing aliases

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 07:14 AM 5/31/00 -0600, Vithalprasad Gaitonde wrote:
>Hi,
>	My question pertains to dereferencing of alias objects by ldap server. 
>If I do a cn=* search with a search base as a container which has aliased objects with an always derefer option, does the server internally; first derefernece all the aliased objects and then apply the filter on the entries or does it first apply the filter, get the matching entries and then derefernce those entries which are aliased objects.
>My question stems from a basic problem.
>Suppose I have 2 ous, ou=myorg1,o=ldap and ou=myorg2,o=ldap. I have cn=user1 inside myorg1. I have cn=user1_alias under myorg2 which is an alias for cn=user1 of myorg1.
>Now if I do the following search:
>ldapsearch -b ou=myorg2,o=ldap -a always mail=usrer1@ldap.com 
>What will this search return.
>If the server first dereferences cn=user_alias to user1 and then apply the mail filter then I will get user1 listed.
>But if the server first applies the filter, cn=user_alias will not match (objectclass alias does not have mail attribute), so the search will return with no matches.


Assuming the server implements aliases, it should return the
aliased object if it matches the filter.

Basically, the server should select all entries in the subtree of
the search, as well as all aliased objects, and then test
each candidate to see if the filter matches and, if so, return it.
Note that some servers use the filter to select candidates
(via indexing).  Such servers must ensure they don't exclude
aliased object that would match the filter during this process.