On 23 mai 2013, at 19:41, Michael Ströder michael@stroeder.com wrote:

pa@marcelot.net wrote:

...

On 23 mai 2013, at 16:31, Howard Chu hyc@symas.com wrote:

...

Don't do that.

Sure, that's why I have a *bad* workaround to not update the 'objectClass' attribute even if the original and my generated one don't match.

IMO this is not a *bad* workaround. I think it's good practice in a UI client to *not* automagically modify attribute 'objectClass' without explicit user interaction asking for modification.

In the case of our UI, we don't even present the entries or attributes as is to the user but in an "abstracted" way. They may not even know it's read/stored internally from/as attributes or entries.

So, yeah, so it's not so *bad*. It's more of an implementation tuning I wish would have not been required, because the modification seemed harmless and legit (according to LDAP standards).

Ciao, Michael.

Regards, Pierre-Arnaud