Re: commit: ldap/doc/man/man5 slapd.access.5

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

Pierangelo Masarati writes:
> - a DN-valued attr is used; then <style> can be "exact"/"base", or
> "subtree" or "children" or "one" and so on.  In all of these cases a
> matching rule can be specified.  Maybe this is useless, because I'm afraid
> that (at present) only distinguishedNameMatch can be used.  I've
> introduced this for symmetry, although for DN-valued attrs value_match()
> is not actually invoked, but a string comparison on the normalized
> relevant portion of the DN is used.

How do you imagine it would work to use both e.g. "subtree" and a
matching rule?  In effect base/subtree/children etc *is* the matching
rule.  (And one which I'd really like to have as a real matching rule to
be used in extensibleMatch filters, BTW:-)

> In fact, one thing that was happening before was that this ACL was
> usable with those DN-valued attrs that do not define an EQUALITY rule,
> which sounds like an inconsistency.

Yup, it treats DNs specially by always using a scope, and the
default, "base", is in practice distinguishedNameMatch.

-- 
Hallvard