slapo-dynlist desgin question(s)

[Quanah Gibson-Mount <quanah@stanford.edu>]

Stanford is looking at implementing groups into our LDAP servers, and in 
particular, looking at using slapo-dynlist.  However, it does not behave as 
I expected it to.

Basically, it uses the credentials of whomever bound to determine the 
membership list.  This means I would have to give access to a privileged 
attribute to those who wished to use groups, which is exactly what I'm 
trying to avoid.  What I wanted to do, was specifically control the access 
to the group objects themselves.  If an entity has access to the group 
object, they would then be able to see all current members of the group.

I believe this would mean adding functionality to slapo-dynlist to where it 
uses the rootdn to perform the internal search instead of the credentials. 
Would it be possible to have this sort of addition?

--Quanah

--
Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html