(ITS#4942) configurable filter blocking

[quanah@OpenLDAP.org]

Full_Name: Quanah Gibson-Mount
Version: NA
OS: NA
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (171.66.155.86)


In reading through the documentation for Fedora DS, I saw an interesting feature
where you can, at the slapd level, disable the ability for clients to execute
filters when the attribute(s) being filtered on are not indexed.  This seems an
interesting feature to me, but I think it could be more worthwhile to make it a
bit more configurable, where you could block certain filter types from being
used, regardless of whether or not they were indexed, and expanded to only
pertain to particular subtrees.

For example, I may want to block subfinal indices on the "suAffiliation"
attribute in the cn=people,dc=stanford,dc=edu tree.

Just food for thought.

--Quanah