Subject: Alias dereferencing in non-search operations

From: "Jim Sermersheim" <[email-masked]>
Date: Fri, 06 Aug 1999 19:12:41 -0600

It looks (to me) like X.500 directories dereference alias entries when resolving 'base' names unless the dontDereferenceAliases serviceControl option is set. In other words, the dontDereferenceAliases option is used like the "derefFindingBaseObj" LDAP search option.

In X.500 this applies to all operations, not just search. In LDAP, there doesn't seem to be a prescribed default behavior when resolving the name specified in operations like BindRequest, ModifyRequest, DelRequest, etc.

If there is a default behavior, how does one change it? In some cases it makes more sense to dereference and others it doesn't. For instance, if I name an alias during a delete, is the alias or the referenced entry deleted? I think most implementations delete the alias, which is probably desirable. On the other hand, Bind is an operation where dereferencing would make sense. Many times aliases are created as a shortcut so that a user's DN isn't so long. In this case, one would want to bind using the alias and have the server automatically dereference.

---

From: Mark Wahl <[email-masked]>
Date: Sat, 07 Aug 1999 15:17:02 -0500

> In X.500 this applies to all operations, not just search. In LDAP, there 
> doesn't seem to be a prescribed default behavior when resolving the name 
> specified in operations like BindRequest, ModifyRequest, DelRequest, etc.

Yes it is.  It is defined in 2251 section 4.8 second paragraph, 
section 4.7 first bullet item, and section 4.6 first bullet item for Delete,
Modify and Add.    For the others we left it to X.500 through 2251 section 
3.3, to minimize the amount of retyping we have to do to produce the RFC.

In particular the behavior for Bind is defined in X.511, where it states that 
the target DN must be the name of an object entry (and therefore not an alias).

> Many times aliases are created as a shortcut so that a user's DN isn't so 
> long. In this case, one would want to bind using the alias and have the 
> server automatically dereference.

That is not a required server behavior however as it would put it in 
contradiction with RFC 2251 3.3 first paragraph second sentence.

Mark Wahl, Directory Product Architect
Innosoft International, Inc.