Subject: RE: When to not deref aliases

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 17 Jan 2001 10:02:33 -0700

>>> "Salter, Thomas A" <[email-masked]> 1/17/01 7:44:23 AM >>>
<snip>
>
>In summary, the X.500 defaults are that operations which read the directory
>dereference aliases and those that modify the directory operate on the alias
>entry itself.

Using this generalized rule, I think the bind operation is still ambiguous as a number of LDAP server implementations both read (password) and update (password policy) the target object.

FWIW, I'd rather make LDAP explicitly state on all operations except bind that aliases are not dereferenced. If dereferencing is needed for other operations, a control can be used. My unconfirmed suspicion is as Kurt believes, that most LDAP vendors behave this way today. If that's not the case, hopefully those people will speak up.

Jim

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 17 Jan 2001 10:00:06 -0800

I think that both RFC 2251 and X.511 are fairly clear
in regards to update operations.  I think the only
real issue is whether bind MUST, MUST NOT, SHOULD,
SHOULD NOT, MAY or MAY NOT do aliasing dereferencing.

I would suggest "SHOULD NOT" as it this does not disallow
an implementation from doing so, but makes it clear that
dereferencing is not expected behavior.

---

From: Ludovic Poitou <[email-masked]>
Date: Thu, 18 Jan 2001 10:12:09 +0100

> dereferencing is not expected behavior.

I think this is the most reasonable approach.
I remember that Sun DS 3.1 had the possibility to deref aliases during a
Bind but this wasn't the default.

Ludovic.

--
Ludovic Poitou
Sun Microsystems Inc.
iPlanet E-Commerce Solutions - Directory Group - Grenoble - France