[Date Prev][Date Next]
Re: commit: ldap/doc/man/man5 slapd.access.5
Pierangelo Masarati writes:
> - a DN-valued attr is used; then <style> can be "exact"/"base", or
> "subtree" or "children" or "one" and so on. In all of these cases a
> matching rule can be specified. Maybe this is useless, because I'm afraid
> that (at present) only distinguishedNameMatch can be used. I've
> introduced this for symmetry, although for DN-valued attrs value_match()
> is not actually invoked, but a string comparison on the normalized
> relevant portion of the DN is used.
How do you imagine it would work to use both e.g. "subtree" and a
matching rule? In effect base/subtree/children etc *is* the matching
rule. (And one which I'd really like to have as a real matching rule to
be used in extensibleMatch filters, BTW:-)
> In fact, one thing that was happening before was that this ACL was
> usable with those DN-valued attrs that do not define an EQUALITY rule,
> which sounds like an inconsistency.
Yup, it treats DNs specially by always using a scope, and the
default, "base", is in practice distinguishedNameMatch.