Subject: PCLS-10: LDAP query for policyRoles

From: "Mircea Pana" <[email-masked]>
Date: Mon, 09 Apr 2001 16:19:03 -0400

WRT. PCLS-10 "5.3. The Three policyRule Classes" (page 27): "This
approach eliminates the extraneous replies, but it requires the PDP to
build the role combinations ("R1&&R2", "R1&&R3", etc.) itself, and it
requires extra queries."

IMO it doesn't necessarily require extra queries. The same result could
be obtained with a single complex query:
(|(policyRoles=R1&&R2)(policyRoles=R1&&R3)etc.). However, LDAP vendor
specific or performance related issues may limit applicability of either
approach.

Regards,
Mircea.