Subject: [Models] can't query RootDSE attributes

From: "Jim Sermersheim" <[email-masked]>
Date: Tue, 12 Oct 2004 09:58:09 -0600

Many of the attributes on the rootDSE are designed such that they cannot
be used in search filters or the compare operation.

altServer, namingContexts, supportedControl, supportedExtension,
supportedLDAPVersion, and supportedSASLMechanisms are all defined
without an EQUALITY matching rule, so a DSA which adheres to [Models]
will not allow these to be compared.

Is there sufficient usefulness in allowing a client to perform a
compare operation against some of these as its method of discovery to
warrant an update to them to include matching rules?

It has also been noted that a similar attribute (supportedFeatures)
does define an EQUALITY rule, thus allowing to be interrogated with
search or compare.

Jim

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 12 Oct 2004 12:58:32 -0700

>warrant an update to them to include matching rules?

No.   Changing schema definitions, even to simply add an
equality rule, can have significant interoperability
impact.  What tends to happen is that client developers
begin to assume that all servers support the new definition,
not realizing that there will be many servers operating
under the old definitions for many years to come.  This
is likely why X.501 says:

    The definition of information objects such as object
    classes, attribute types, matching rules and name forms
    which have been registered (i.e. assigned a name of type
    object identifier) are static and cannot be modified.
    Changes to the semantics of such information objects
    requires the assignment of new object identifiers.

In regards to these attributes, change could lead to a
client not being able to discover support for some
capability, such as the Start TLS extended operation or
a particular SASL mechanism of interest.

Kurt