[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: [ldapext] Nested group expansion control



Andrew Findlay wrote:
On Wed, Sep 19, 2007 at 12:42:12PM -0400, simo wrote:

The algorithm complexity is the same, although, it is true, a client may
require more operations.

Actually I think this problem would be better solved by a control to ask
the server to do the calculations for us (and IIRC there is a control
like that in the AD implementation called ASQ or something like that)
and use a cache, so we have both an efficient way to do it and avoid the
artificial distinction.

Server support would certainly be valuable in many cases and a control sounds like a good way to ask for it. However, I think that is orthogonal to the question of whether there should be two attributes.

Digressing down this path briefly... Such a control should probably have a depth/recursion limit as a parameter. Servers would have to be smart about how this control is propagated in a distributed environment, e.g. if certain nestedGroup DNs reside on remote servers. (Though in practice, just as with search limits, clients will probably most often ask for "unlimited" and leave it up to the server to restrict it.)
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/


_______________________________________________
Ldapext mailing list
Ldapext@ietf.org
https://www1.ietf.org/mailman/listinfo/ldapext