Subject: Re: [ldapext] Re: draft-ietf-boreham-numsubordinates-01.txt

From: John McMeeking <[email-masked]>
Date: Fri, 24 Oct 2003 09:19:23 -0500

I'd vote for including subentries.

The X.501 text allows hasSubordinate to be true if the only children are
subentries.  It seems a bit inconsistent to return hasSubordinates=TRUE and
numSubordinates=0.  I would expect that there will be cases (no access,
subentries, maybe other cases) where numSubordinates or hasSubordinates
will indicate the presence of entries that don't seem to be there.

John  McMeeking

                      "David Boreham"                                                                               
                      <david@bozemanpas        To:       <[email-masked]>, <[email-masked]>, "'Ldapext    
                      s.com>                    (E-mail)'" <[email-masked]>                                       
                      Sent by:                 cc:                                                                  
                      ldapext-admin@iet        Subject:  [ldapext] Re: draft-ietf-boreham-numsubordinates-01.txt    
                      f.org                                                                                         

                      10/23/2003 09:03                                                                              
                      PM                                                                                            

> Firstly I'm curious as to what `numSubordinates' identifies as being a
> subordinate?
> Eg. Is a subentry counted as a subordinate?

Good question, and I remember this coming up when I implemented the
feature.
My vote would be to not count subentries, but I'm interested to hear what
other folks think.

> The SYNTAX is incorrect. It should be 1.3.6.1.4.1.1466.115.121.1.27

Thanks. I suspect this was a typo as I had an old copy
of the document with the correct syntax OID (which I
un-corrected thinking that it was an error since it didn't
match the 1999 version of the document).

> >Servers MUST ensure that the value returned in the numSubordinates
> >attibute to clients is consistent with the view that client has of other
> >server contents.
>
> Is this suggesting that the numSubordinates value should take access
control
> information into consideration, and only provide an indication of how
many
> subordinate entries the user has access to?

Yes.

> >The  X.500  hasSubordinates  operational  attribute[ITU-X501] can be
> >regarded  as indicating whether numSubordinates has a non-zero value for
> >the same entry. This leads to the potential for optimization in a server
> >implementation, in that it isn't necessary to store both values.
>
> This may not be exactly the case, as a TRUE value of the
`hasSubordinates'
> attribute only indicates that subordinates _may_ exist.
> As stated in X501:
>
> A value of TRUE may be returned when no subordinates exist if all
possible
> subordinates are available only through a
> non-specific subordinate reference (see ITU-T Rec. X.518 | ISO/IEC
9594-4)
> or if the only subordinates are subentries or child
> family members.

Hmm...interesting. I'm happy to remove the paragraph referencing X.501.

_______________________________________________
Ldapext mailing list
[email-masked]
 https://www1.ietf.org/mailman/listinfo/ldapext

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: Ludovic Poitou <[email-masked]>
Date: Fri, 24 Oct 2003 16:40:27 +0200

I'd vote for including subentries as well...
You can have a numSubordinate != 0 and not being able to see children 
entries (due to access controls).
But having numSubordinate = 0 and getting a NON_LEAF error when deleting 
the entry will be be perceived as more confusing.

Ludovic.

---

From: Michael Ströder <[email-masked]>
Date: Fri, 24 Oct 2003 20:49:55 +0200

> I'd vote for including subentries as well...

Any use-cases for including subentries?
Which are the use-cases for 'numSubordinates'?

> entries (due to access controls).

Yes. But what's the problem with that?

> the entry will be be perceived as more confusing.

Does this really happen at all? Maybe I don't understand this sentence.

Ciao, Michael.

---

From: Ludovic Poitou <[email-masked]>
Date: Mon, 27 Oct 2003 18:10:04 +0100

> Which are the use-cases for 'numSubordinates'?

The question was whether SubEntries should be counted in the 
numSubordinate operational attribute.
My vote was yes...

> Yes. But what's the problem with that?

No problem. If subentries are counted in the numSubordinate attribute, 
an entry that has subEntries will have a positive numSubordinate but 
regular client applications won't see any child entries. Some apps may 
be confused by this behavior, but this can already happen with ACI.

As opposed, not counting SubEntries in the numSubordinate attribute, an 
application can read the numSubordiante attribute, see its value is 0, 
delete the entry and get a NON_LEAF error... and be confused....

I prefer the first scenario to the second one.

>
>> But having numSubordinate = 0 and getting a NON_LEAF error when 
>> deleting the entry will be be perceived as more confusing.
>
>
This is what would happen if Subentries are NOT counted as numSubordinate.

Ludovic.

---

From: Michael Ströder <[email-masked]>
Date: Tue, 28 Oct 2003 09:25:01 +0100

> numSubordinate operational attribute.

This question simply can't be answered without looking at possible use-cases 
for this attribute.

> If subentries are counted in the numSubordinate attribute, 

Yes, this is the same issue like any scenario with ACI/ACLs in effect.

> delete the entry and get a NON_LEAF error... and be confused....

IMHO

entry is leaf entry
   <=> value of hasSubordinates is 'FALSE'
   <=> value of numSubordinates is '0'

no matter whether you count all sub entries or just the next level.

Examples (please correct me if I got it wrong):

1. Counting all sub entries in numSubordinates:

dc=test,dc=com (numSubordinates: 5)
|
+-ou=Test1 (numSubordinates: 0)
|
+-ou=Test2 (numSubordinates: 3)
   |
   +-cn=Testperson1 (numSubordinates: 0)
   |
   +-cn=Testperson2 (numSubordinates: 1)
     |
     +-mail=[email-masked] (numSubordinates: 0)

2. Counting only one-level in numSubordinates (similar to what's another 
vendor is doing in an attribute called 'subordinateCount'):

dc=test,dc=com (numSubordinates: 2)
|
+-ou=Test1 (numSubordinates: 0)
|
+-ou=Test2 (numSubordinates: 2)
   |
   +-cn=Testperson1 (numSubordinates: 0)
   |
   +-cn=Testperson2 (numSubordinates: 1)
     |
     +-mail=[email-masked] (numSubordinates: 0)

As you can see in any scenario leaf-entries have numSubordinates set to zero.

Hmm, maybe I don't understand the word "SubEntries" correctly?
Maybe you are talking about sub entries like sub schema sub entry?

Ciao, Michael.