Subject: [ldapext] LDAP and subtree specification and subentries

From: "Jochen Keutel" <[email-masked]>
Date: Sun, 21 Apr 2002 11:49:33 +0200

Hello,
  
RFC2252 lists in 4.3.2 a syntax

Subtree Specification           Y  1.3.6.1.4.1.1466.115.121.1.45

However - there is no further definition of the syntax.

Question: Where is defined how values of attributes of syntax subtree specification (esp. values of the attribute subtreeSpecification) have to be encoded?

One product (Syntegra LDE) is doing it this way:

subtreeSpecification: $ minimum:0    

Is this correct???

Other general question: Is it allowed to search / to modify objects of DSE-Type subentry (e.g. collective-attribute-subentries) via LDAP?

Best regards,

Jochen Keutel. 

---
Dr. Jochen Keutel
Management Consultancy
Wusterhausener Str. 8
D-15732 Eichwalde
Germany
phone +49 30 678 19189
mobile +49 177 6572720
e-mail [email-masked]

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "Steven Legg" <[email-masked]>
Date: Mon, 22 Apr 2002 12:14:36 +1000

Jochen,

Jochen Keutel wrote:
> Question: Where is defined how values of attributes of syntax 
> subtree specification (esp. values of the attribute 
> subtreeSpecification) have to be encoded?

There is no standard definition of the LDAP-specific encoding
for the Subtree Specification syntax. An early draft of the I-D
that led to RFC 2252 (draft-ietf-asid-ldapv3-attributes-03.txt)
defined an LDAP-specific encoding for SubtreeSpecification but
this did not make it into the final RFC.

There is an Internet draft, draft-zeilenga-ldap-subentry-03.txt,
currently being reviewed by the IESG, that defines the LDAP-specific
encoding for the Subtree Specification syntax.

> subtreeSpecification: $ minimum:0    

It would appear to be a proprietary format. It doesn't fit either
the format described in draft-ietf-asid-ldapv3-attributes-03.txt
or the format defined in draft-zeilenga-ldap-subentry-03.txt.

> 
> Other general question: Is it allowed to search / to modify 
> objects of DSE-Type subentry (e.g. 
> collective-attribute-subentries) via LDAP?

Yes.

Regards,
Steven

---

From: "Jochen Keutel" <[email-masked]>
Date: Mon, 22 Apr 2002 09:14:50 +0200

Hello,

> > collective-attribute-subentries) via LDAP?

OK - it's allowed. But it's not really possible because
I can't express some attributes, e.g. subtreeSpecification, in LDAP.

You are right: draft-zeilenga-ldap-subentry-03.txt solves
this problem - but only for subtreeSpecification.
I still can't see how to express
the other attributes I usually find in (X.500) subentries, e.g.

- prescriptiveACI for access control subentries
- DIT content rules and structure rules for subschema subentries
- collective attributes for collective attributes subentries
(e.g. collectiveTelephoneNumber (X.520))

The last one seems to be addressed by draft-zeilenga-ldap-collective-06.txt,
but not the other two kinds of subentries.

So it seems that today each X.500 vendor has a vendor-specific (or no) representation
of these subentries when read / modified via LDAP.

Best regards,

Jochen Keutel. 

---
Dr. Jochen Keutel
Management Consultancy
Wusterhausener Str. 8
D-15732 Eichwalde
Germany
phone +49 30 678 19189
mobile +49 177 6572720
e-mail [email-masked]

---

From: "Steven Legg" <[email-masked]>
Date: Tue, 23 Apr 2002 10:55:48 +1000

Jochen,

> I can't express some attributes, e.g. subtreeSpecification, in LDAP.

In the worst case, LDAP allows all attribute and assertion syntaxes
defined in X.500 to be transfered in the LDAP protocol in BER format
by using ";binary".

The extent to which any particular LDAP product supports this capability
is a separate issue.

> - prescriptiveACI for access control subentries

I have proposed an LDAP-specific encoding for the ACI Item syntax in
draft-legg-ldap-acm-bac-00.txt.

> - DIT content rules and structure rules for subschema subentries

LDAP-specific encodings for these are already defined in RFC 2252.

> (e.g. collectiveTelephoneNumber (X.520))

The LDAP-specific encodings for collective attributes are simply the
same as their non-collective counterparts since they share the same
attribute syntaxes.

> of these subentries when read / modified via LDAP.

Currently, the only LDAP standard representation defined for
things like subtree specifications, ACI items, etc, is the
";binary" representation. This will change. The I-Ds Kurt and
I have submitted complete the definition of human-readable
LDAP-specific encodings for all the subentry operational
attributes.

Regards,
Steven