RE: SASL LDAP plugin

["Howard Chu" <hyc@highlandsun.com>]

> -----Original Message-----
> From: Kurt D. Zeilenga [mailto:Kurt@OpenLDAP.org]

> >> The control must be managed by the frontend (with calls into
> >> backend as needed)... there's no DN.

> >Right. Getting back to allowing this control to be meaningfully proxied
> >by back-ldap: we need to be able to query the remote server's
> mapping rules.
> >Perhaps they should be added to back-monitor. The back-ldap
> proxy could be
> >configured to fetch the rules at startup and feed them into the local
> >runtime configuration. Then the control will still be usable on the proxy
> >server.

> I rather have the proxy server use a "who is this?" extended operation
> in this case.

That makes sense for portability. But then we need to allow the original
request to carry a DN (e.g., the back-ldap suffix), or have some other
mechanism of getting back-ldap selected. We also need to tell the front-end
that it's OK if the front-end mapping operation gets no matches (treat as
no-op), and let the backend handle the control.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support