Re: acl again

[Stig Venaas <Stig@OpenLDAP.org>]

On Thu, Nov 08, 2001 at 05:56:38PM +0100, Pierangelo Masarati wrote:
> > 
> > Hi there,
> > 
> > ok, the main wattles about regex i check, but why does this rule dont
> > work?
> > 
> > ---
> > access to dn="(dc=[^,]+,)*(dc=[^,]+)$"
> > 	by group/organizationalRole/roleOccupant="cn=Domain Administrator, ou=Roles, $1 $2" write
> 
> Before going into details, remember that ACLs and significantly regexes
> operate on NORMALIZED DNs, so you'd write:
> 
> 
> access to dn="(dc=[^,]+,)*(dc=[^,]+)$"
>     by group/organizationalRole/roleOccupant="cn=Domain Administrator,ou=Roles,$1$2" write
> 
> 
> without extra intervening spaces.

Maybe we should try to normalize that in the code when parsing the rule?
I should look into Unicode and ACLs, we need to decide what to try to
normalize though. Normalization and regexps are a bit awkward, even more
so when taking Unicode into account.

Stig