Subject: cross-schema DIT structure rules

From: Hallvard B Furuseth <[email-masked]>
Date: Sun, 8 Dec 2002 16:14:16 +0100

if "c=NO" and "st=Oslo,c=NO" have different subschema subentries, and
the schema (DIT structure rules and name forms) at "c=NO" allow ST to be
below C but the schema at "st=Oslo,c=NO" does not allow it, which rules
apply?

For that matter, do structure rules and name forms for an entry apply to
the whole DN or just the first part?  That is, if I have "st=Oslo,c=NO",
can I create "o=UiO,st=Oslo,c=NO" with its own schema which does not
allow ST below C?

-- 
Hallvard

---

From: "Steven Legg" <[email-masked]>
Date: Mon, 9 Dec 2002 10:41:36 +1100

Hallvard,

> below C but the schema at "st=Oslo,c=NO" does not allow it, 

The latter, sort of. In the X.500 model, for "c=NO" and "st=Oslo,c=NO"
to have different subschema subentries they would have to be subschema
administrative points for separate subschema administrative areas.
The structure rule that applies to a subschema administrative point
must be one that specifies no superior structure rules. The governing
structure rule of the superior entry of a subschema administrative
point is always irrelevant (as it must be since structure rule IDs
are not globally unique), and thus subschema administrative areas
are self-contained. The subschema for "st=Oslo,c=NO" must contain a
structure rule, for state entries, that specifies no superior rules.
Since structure rules only allow things, rather than disallow things,
the subschema for "st=Oslo,c=NO" technically does not "allow ST to be
below C", by omission, but it's a moot point.

> the whole DN or just the first part?

Just the first part (in LDAP terms). The name forms and structure
rules for each superior entry are determined with respect to the
subschema that applies to that superior entry.

> That is, if I have 
> "st=Oslo,c=NO",

Yes, but the definitions for ST and C would be irrelevant since
the subschema administrative area (i.e. subtree) for "o=UiO,st=Oslo,c=NO"
presumably contains no country or state entries. However there would
need to be a structure rule, for organization entries, that specifies
no superior structure rules.

Regards,
Steven

---

From: Hallvard B Furuseth <[email-masked]>
Date: Wed, 11 Dec 2002 12:16:58 +0100

Steven Legg writes:
> must be one that specifies no superior structure rules.

Then I suggest this addition to [Models] 4.1.6:

  If an object or alias entry's subschemaSubentry attribute differs from
  that of its parent, any DIT structure rule which applies to it must
  not have a 'SUP' part.

>> For that matter, do structure rules and name forms for an 
>> entry apply to the whole DN or just the first part?
> 
> Just the first part (in LDAP terms).

I'd like that added too, but I can't come up with a brief wording.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 11 Dec 2002 12:54:51 -0800

>  that of its parent, any DIT structure rule which applies to it must

I think I rather say (paraphrasing from X.501):
  If no SUPerior rules are identified, the DIT structure rule applies
  to an autonomous administrative point (e.g. the root vertex of the 
  subtree controlled by the subschema) [X.501].

>I'd like that added too, but I can't come up with a brief wording.

I think its already reasonable clear that name forms apply to the
RDN, not to the whole DN.

Kurt