Subject: What Does De-Reference Mean?

From: Chris Harding <[email-masked]>
Date: Wed, 26 Mar 2003 19:22:56 +0000

Hi -

The interpretation of the LDAP RFCs as regards dereferencing has become an 
issue for the new certification program that The Open Group plans to launch 
for LDAP servers. We have discussed it in the Directory Interoperability 
Forum, and agreed that we should ask the experts in the ldapbis group. 
Accordingly, I would like to ask your help in clarifying this issue.

Here's the issue. The requirement in the specification is:

        When a server receives a search request with the derefAliases field
        set to derefInSearching then it will dereference aliases in 
subordinates
        of the base object in searching.

We have a test suite for use in the certification program. The suite 
includes a test of this requirement (which is in fact derived from a test 
in BLITS). The test data includes two entries: Jonathan Adams and Jonny 
Adams. The Jonny Adams entry is an alias for Jonathan Adams.

The test should check that Jonny Adams is de-referenced and Jonathan Adams 
is returned. The question is, should the test search for Jonny or for 
Jonathan.

RFC 2251 does not explain dereferencing but defers to X.501. Unfortunately, 
X.501 does not seem to explain it very well. My personal interpretation 
after reading it is that, whenever a server encounters an alias entry in 
the course of a search and dereferencing has been requested, the server 
should dereference the alias and carry on searching from the entry that the 
alias points to. Under this interpretation, a search for Jonny should 
return the same result as a search for Jonathan - the Jonathan Adams entry.

I don't claim to be an expert on the interpretation of the specifications - 
but I hope that experts in the IETF community can shed light on this!

Please send your comments to the ldapbis list. I will report the consensus 
(assuming that one is reached) to the DIF.

Regards,

Chris
+++++

========================================================================
            Dr. Christopher J. Harding
   T H E    Executive Director for the Directory Interoperability Forum
  O P E N   Apex Plaza, Forbury Road, Reading RG1 1AX, UK
G R O U P  Mailto:[email-masked] Phone: +44 118 902 3018
            WWW: http://www.opengroup.org Mobile: +44 774 063 1520
========================================================================

             The Open Group's Consortia Services - Association Management 
For I.T.:
             http://www.opengroup.org/consortia_services

========================================================================

---

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 26 Mar 2003 22:15:38 -0700

If I remember right, the search filter is something like (cn=Jonny). If
derefInSearching is set, then my read says that the search will not
return an entry. Though not explicitly stated, I think the notion is
that an entry is dereferenced before the filter is applied, not the
other way around. Therefore, if the search filter is (cn=Johny), and
we're dereferencing while searching, we would first dereference the
Jonny object to the Johnathan object, then apply the filter to the
Johnathen object.

Jim

>>> Chris Harding <[email-masked]> 3/26/03 12:22:56 PM >>>
Hi -

The interpretation of the LDAP RFCs as regards dereferencing has become
an 
issue for the new certification program that The Open Group plans to
launch 
for LDAP servers. We have discussed it in the Directory
Interoperability 
Forum, and agreed that we should ask the experts in the ldapbis group.

        When a server receives a search request with the derefAliases
field
        set to derefInSearching then it will dereference aliases in 
subordinates
        of the base object in searching.

We have a test suite for use in the certification program. The suite 
includes a test of this requirement (which is in fact derived from a
test 
in BLITS). The test data includes two entries: Jonathan Adams and Jonny

The test should check that Jonny Adams is de-referenced and Jonathan
Adams 
is returned. The question is, should the test search for Jonny or for 
Jonathan.

RFC 2251 does not explain dereferencing but defers to X.501.
Unfortunately, 
X.501 does not seem to explain it very well. My personal interpretation

after reading it is that, whenever a server encounters an alias entry
in 
the course of a search and dereferencing has been requested, the server

should dereference the alias and carry on searching from the entry that
the 
alias points to. Under this interpretation, a search for Jonny should 
return the same result as a search for Jonathan - the Jonathan Adams
entry.

I don't claim to be an expert on the interpretation of the
specifications - 
but I hope that experts in the IETF community can shed light on this!

Please send your comments to the ldapbis list. I will report the
consensus 
(assuming that one is reached) to the DIF.

Regards,

Chris
+++++

   T H E    Executive Director for the Directory Interoperability
Forum

             The Open Group's Consortia Services - Association
Management 
For I.T.:
             http://www.opengroup.org/consortia_services

---

From: John McMeeking <[email-masked]>
Date: Fri, 28 Mar 2003 11:24:27 -0600

Is this discussion purely for the purpose of determining the correct
behavior of test cases?  Or, are the test cases mentioned implementing some
recommended approach to handling some issue (hopefully not defining
nicknames for users)?

I ask because in my experience, aliases are not well understood, which
makes them easy to misuse, and there are often significant performance
impacts.

If this is just for a test case, fine.  But I'd like to know if this
associated with some directory usage guidelines.

John  McMeeking

                      Chris Harding                                                                                             
                      <c.harding@opengroup        To:       "Kurt D. Zeilenga" <[email-masked]>                              
                      .org>                       cc:       [email-masked], [email-masked],                
                      Sent by:                     [email-masked]                                                    
                      owner-ietf-ldapbis@O        Subject:  Re: What Does De-Reference Mean?                                    
                      penLDAP.org                                                                                               

                      03/28/2003 10:18 AM                                                                                       

Hi, Kurt -

Thanks for this response. It clearly implies that if there is an entry
"Jonathan Adams" and an alias entry "Jonny Adams" that points to it then:

    - a search for "Jonathan Adams" with alias dereferencing requested
      should return the Jonathan Adams entry

    - a search for "Jonny Adams" with alias dereferencing requested
      should not return either entry.

Does anyone disagree with this interpretation?

At 15:42 27/03/2003 -0800, Kurt D. Zeilenga wrote:
>It should be clear that each and every entry returned in
>response to a search request did match the search filter.  That
>is, if the filter is (CN=foo) than each entry returned has "foo"
>as a (not necessarily returned) value of an attribute whose
>type is CN or a subtype of CN.
>
>When dereferencing during searching (by derefInSearching or
>derefAlways), the filter should be matched against the entry which
>the alias refers to, not the alias itself.
>
>If the client asks for all alias objects, e.g, (objectClass=alias)
>with dereferencing during finding enabled, then no entries should
>be returned.  Likewise, when requesting (objectClass=*) with
>dereferencing during finding enabled, none of entries returned
>should belong to the alias objectClass.
>
>So, to answer your specific question, it is not relevant to
>the matching what values of CN the 'alias' has. The values
>of the aliased entry are, however, quite relevant.
>
>Kurt
>
>
>At 11:22 AM 3/26/2003, Chris Harding wrote:
> >Hi -
> >
> an issue for the new certification program that The Open Group plans to
> launch for LDAP servers. We have discussed it in the Directory
> Interoperability Forum, and agreed that we should ask the experts in the
> ldapbis group. Accordingly, I would like to ask your help in clarifying
> this issue.
> >
field

> Adams is returned. The question is, should the test search for Jonny or
> for Jonathan.
> >
> Unfortunately, X.501 does not seem to explain it very well. My personal
> interpretation after reading it is that, whenever a server encounters an
> alias entry in the course of a search and dereferencing has been
> requested, the server should dereference the alias and carry on searching

> from the entry that the alias points to. Under this interpretation, a
> search for Jonny should return the same result as a search for Jonathan -

> the Jonathan Adams entry.
> >
> specifications - but I hope that experts in the IETF community can shed
> light on this!
> >
> consensus (assuming that one is reached) to the DIF.
> >
> >Regards,
> >
> >Chris
> >+++++
> >

Regards,

Chris
+++++

---

From: "Jim Sermersheim" <[email-masked]>
Date: Fri, 28 Mar 2003 19:21:45 -0700

<some content stolen from the original message>
It's for a certification program that The Open Group plans to launch
for LDAP servers. I believe the certification program is aimed at
directory interoperability, and facilitates a test suite which includes
this test case which is in fact derived from a test in BLITS.

I don't think they plan to marry the interoperability test suite with
any kind of directory usage guidelines.

Jim

>>> John McMeeking <[email-masked]> 3/28/03 10:24:27 AM >>>

Is this discussion purely for the purpose of determining the correct
behavior of test cases?  Or, are the test cases mentioned implementing
some
recommended approach to handling some issue (hopefully not defining
nicknames for users)?

John  McMeeking

                                                        
                      Chris Harding                                    
                                                        
                      <c.harding@opengroup        To:       "Kurt D.
Zeilenga" <[email-masked]>                              
                      .org>                       cc:      
[email-masked], [email-masked],                
                      Sent by:                    
[email-masked]                                            
       
                      owner-ietf-ldapbis@O        Subject:  Re: What
Does De-Reference Mean?                                    
                      penLDAP.org                                      

                      03/28/2003 10:18 AM                              

Hi, Kurt -

Thanks for this response. It clearly implies that if there is an entry
"Jonathan Adams" and an alias entry "Jonny Adams" that points to it
then:

field
test

Forum
Management

Regards,

Chris
+++++

---

From: Chris Harding <[email-masked]>
Date: Fri, 28 Mar 2003 18:29:05 +0000

Hi, John -

It's more than test cases. The test suite will support The Open Group's new 
certification programs - "LDAP Certified" and "LDAP Ready". Servers will 
have to behave correctly in order to be certified. This is why we are 
trying to establish what the correct behavior is!

> Harding 
>                       03/28/2003 10:18 
> AM 

Regards,

Chris
+++++