RE: cross-schema DIT structure rules

["Steven Legg" <steven.legg@adacel.com.au>]

Hallvard,

Hallvard B Furuseth wrote:
> if "c=NO" and "st=Oslo,c=NO" have different subschema subentries, and
> the schema (DIT structure rules and name forms) at "c=NO" 
> allow ST to be
> below C but the schema at "st=Oslo,c=NO" does not allow it, 
> which rules
> apply?

The latter, sort of. In the X.500 model, for "c=NO" and "st=Oslo,c=NO"
to have different subschema subentries they would have to be subschema
administrative points for separate subschema administrative areas.
The structure rule that applies to a subschema administrative point
must be one that specifies no superior structure rules. The governing
structure rule of the superior entry of a subschema administrative
point is always irrelevant (as it must be since structure rule IDs
are not globally unique), and thus subschema administrative areas
are self-contained. The subschema for "st=Oslo,c=NO" must contain a
structure rule, for state entries, that specifies no superior rules.
Since structure rules only allow things, rather than disallow things,
the subschema for "st=Oslo,c=NO" technically does not "allow ST to be
below C", by omission, but it's a moot point.

> 
> For that matter, do structure rules and name forms for an 
> entry apply to
> the whole DN or just the first part?

Just the first part (in LDAP terms). The name forms and structure
rules for each superior entry are determined with respect to the
subschema that applies to that superior entry.

> That is, if I have 
> "st=Oslo,c=NO",
> can I create "o=UiO,st=Oslo,c=NO" with its own schema which does not
> allow ST below C?

Yes, but the definitions for ST and C would be irrelevant since
the subschema administrative area (i.e. subtree) for "o=UiO,st=Oslo,c=NO"
presumably contains no country or state entries. However there would
need to be a structure rule, for organization entries, that specifies
no superior structure rules.

Regards,
Steven