Subject: protocol-26: matchedDN

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 20 Sep 2004 16:06:34 -0700

In review this I-D, aside from a number of editorial
issues (which I will separately send to Jim), I found
a few of minor issues for the WG to consider.

Section 4.1.9 says:
  [T]he matchedDN field is set to the name of the lowest
  entry (object or alias) in the Directory that was matched.

The name returned may not actually be the lowest
entry in the Directory used in finding the target object.
That is, two entry A and B may be used in finding X.
While A might be lower than B in finding X, B should
be returned if it was used in finding X after A.
Seems this would be better worded:
	[T]the matchedDN field is set to the name of the
	last entry (object or alias) used in finding
	the target (or base) object.

This wording also avoids the 'matched' (as it's not
clear to me what matches the entry named in matchedDN).

Kurt

---

From: "Ramsay, Ron" <[email-masked]>
Date: Tue, 21 Sep 2004 11:47:35 +1000

If access control prevented access to the object in question, the 'matchedDN' field should not contain the name of the entry if permission to return the name is not granted by access controls.

Ron

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Kurt D. Zeilenga
Sent: Tuesday, 21 September 2004 09:07
To: [email-masked]
Subject: protocol-26: matchedDN

Section 4.1.9 says:

Kurt