Back-ldap and matchedDN (Was: (ITS#3942))

[Pierangelo Masarati <ando@sys-net.it>]

I note that now back-ldap, as a consequence of retaining anything comes 
from ldap_parse_result(), in case it hits a referral it returns bot the 
ref and the matchedDN.  For example, in test039, there is a referral 
entry "cn=Somewhere,ou=Meta,o=Example,c=US".  According to 
draft-ietf-ldapbis-protocol, the matchedDN can should be returned with 
some specific errors, but could be returned also with other 
errors/return codes, I guess including referral return codes.  When 
searching for, e.g. "cn=Deeper,cn=Somewhere,ou=Meta,o=Example,c=US", 
back-ldap returns a matchedDN="cn=Somewhere,ou=Meta,o=Example,c=US" and 
a ref="ldap:///cn=Deeper,cn=Somewhere,ou=Meta,o=Example,c=US";.  In this 
case, the matchedDN might make sense, because the ref indicates how to 
continue the operation, while the matchedDN indicates what portion of 
the DN was present locally.  But when searching exactly for 
"cn=Somewhere,ou=Meta,o=Example,c=US" one gets both 
matchedDN="cn=Somewhere,ou=Meta,o=Example,c=US" and 
ref="ldap:///cn=Somewhere,ou=Meta,o=Example,c=US";.  I suspect in this 
latter case the matchedDN is definitely redundant.  Should it be 
trimmed?  I couldn't find a clear answer in the specs.

p.


   SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497