Subject: Subentries: Need for a control to access?

From: "Ed Reed" <[email-masked]>
Date: Fri, 20 Aug 1999 15:03:17 -0600

In section 3.1 of the draft (http://www.ietf.org/internet-drafts/draft-ietf-ldup-subentry-00.txt) it says 

"NOTE:  No special treatment of LDAP Subentries by applications is
required, but it might be worth considering creating an LDAPv3 control
to indicate when LDAP Subentries are desired to be returned (subject
to access controls and search filters, of course) for LDAP search
operations."

After discussions with others on the list, I think there is no need for
a separate control, after all.

If entries derived from the lDAPsubEntry class are NOT returned to
search operations UNLESS SPECIFICALLY ASKED FOR by
including a matching criteria "objectclass=LDAPsubentry" in the
search match specification, then that critera accomplishes the same
goal that a control would...to explicitly include such entries in the
scope of operations requested.

So, I'm proposing that the NOTE be changed to read...

"NOTE:  No special treatment of LDAP Subentries by applications
or directory services is required.  However, servers which DO provide
special handling MUST do so in the following way:  

a) search operations which include a matching criteria 
"objectclass=lDAPsubEntry" MUST include entries derived from 
the lDAPsubEntry class in the scope of their operations;  

b) search operations which do not include a matching
criteria "objectclass=lDAPsubEntry" MUST IGNORE entries
derived from the lDAPsubEntry class, and exclude them from the scope
of their operations."

Thus, a special control no longer seems necessary.  Agreed?

=================
Ed Reed, Technologist
Novell Product Management
+1 801 222 3944 (new number!)

---

From: [email-masked] (David Boreham)
Date: Fri, 20 Aug 1999 14:13:38 -0700

> Thus, a special control no longer seems necessary.  Agreed?

Yes.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 20 Aug 1999 14:22:53 -0700

>special handling MUST do so in the following way:  

Is there an overriding reason why this must be a MUST?  I'd
much prefer a "SHOULD".

---

From: Mark Smith <[email-masked]>
Date: Fri, 20 Aug 1999 17:43:24 -0400

> Is there an overriding reason why this must be a MUST?  I'd

I think it would be a good idea to encourage everyone to support special
handling of LDAP Subentries.  I'd like to see the entire "NOTE" replaced
by a SHOULD, e.g.,:

"Servers SHOULD implement the following special handling of LDAPsubentry
entries: ..."

This still leaves room for a particular implementation to not support
the special handling specified in the draft or to do something else
instead if there is a valid reason to do so.

-- 
Mark Smith
iPlanet Directory Architect / Sun-Netscape Alliance
My words are my own, not my employer's.   Got LDAP?