From masarati@aero.polimi.it Thu Jan 20 13:55:22 2011
From: masarati@aero.polimi.it
To: openldap-bugs@openldap.org
Subject:
 Re: (ITS#6801) New feature,	add subtree-include support in meta backend
Date: Thu, 20 Jan 2011 13:55:22 +0000
Message-ID: <201101201355.p0KDtMC9050100@boole.openldap.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2958880141862160245=="

--===============2958880141862160245==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

jorge.perez.burgos(a)ericsson.com wrote:
> Full_Name: Jorge Perez Burgos
> Version: 2.4.21
> OS: linux
> URL: ftp://ftp.openldap.org/incoming/
> Submission from: (NULL) (195.235.15.243)
>=20
>=20
> I'd suggest to introduce a "subtree-include" directive, mutually exclusive =
with
> "subtree-exclude", with different syntaxes, like:
>=20
> "[dn[.<style>]:]<pattern>"
>=20
> where <style> can be "subtree" or "regex" (other styles like "exact",
> "onelevel", "subordinate" could make sense but would be of limited usefulne=
ss);
> so, for example
>=20
> "dn.subtree:<dn>" ("dn.subtree" implicit for backward compatibility)
> "dn.regex:<pattern>"=20
>=20
> The "dn.<style>:" prefix is consistent with other features like ACLs, limit=
s and
> so.  There's ITS#5877 open about making this uniform across slapd for all
> features.
>=20
> Multiple patterns could be defined; the first that matches would stop execu=
tion.
>  If configured as "subtree-exclude", a match would qualify the target as
> "non-candidate" (current behavior for "subtree-exclude").  If configured as
> "subtree-include", a match would qualify the target as "candidate".

Jorge and I discussed this off-line; suggestions are welcome, otherwise=20
I'd implement it this way right now with ad-hoc code, and eventually=20
turn it into a generally useful feature that could be reused in ACLs,=20
limits, authz, and in other to-be-defined features.

p.



--===============2958880141862160245==--