Subject: [ldapext] when is manageDsaIT needed for the root DSE?

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 22 Sep 2004 17:14:39 -0600

>From my read of X.501 (and others) is that the ManageDsaIT control is
required to read and update the root DSE. If this is the case, LDAP has
explicitly overriden that requirement by allowing a specific search
operation* to read it, and implies that it may be updated without the
use of ManageDsaIT.

It seems obvious to me that when a wholeSubtree or singleLevel scope
search has an empty base, that a referral is returned when the DSA is
not a first-level DSA (if ManageDsaIT is not used). I also assume that
an add of an object immediately subordinate to the root will also cause
a referral when ManageDsaIT is not used on a anon-first-level DSA.

I don't know what the behavior of a variant of the specific search
operation* where a differnt filter is used should be. I also don't know
what the behavior of compare should be.

I'm trying to reconcile this with the distributed procedures document.
It currently says:
If a DSE held by a DSA meets all of the following criteria, it is said
to be local to that DSA:
- It is or falls (hierarchically) under and administrative point.
- it is a DSE of any of the types:
  - root
  - cp
  - entry
  - alias
  - subentry

Well, the root never falls under (nor is to my knowledge) an ap, so I
should just remove it from the list. But for LDAP, it seems some
exeption needs to be made for at least the specific search operation*,
and maybe an exception for the modify operation on the empty DN.

Or is my initial assumption just wrong? 

* The specific search operation is where the scope is baseObject, the
base is empty, and the filter is (objectclass=*).

Thanks for any clarification.

Jim

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 22 Sep 2004 17:50:28 -0700

Though I said "I disagree" over on the LDAPBIS list, in
retrospect, I would have to minimally agree that a server
*could* returning the rootDSE in response to subtree
manageDsaIt search.  RFC 3296 says:
   The control MAY cause other objects to be treated as
   normal entries as defined by subsequent documents.

While there is no subsequent document stating how this
control would cause rootDSE to be treated as a normal
entry, I think it reasonable that some subsequent document
could state how.  I would hope that any such document
would state a how consistent with X.511(97) manageDsaIt
service.

Are you able to reconcile things if you assume that
the rootDSE is treated as a normal object in
manageDsaIT searches with baseObject=""? 

Kurt