Re: slapo-constraint type uri: Constrained attribute used in LDAP URL

[Howard Chu <hyc@symas.com>]

Michael Ströder wrote:
> Howard Chu wrote:
> > Michael Ströder wrote:
> > > Consider the following config for slapo-constraint in slapd.conf:
> > >
> > > constraint_attribute ou uri
> > >      ldap:///o=Test Company?ou?sub?(objectClass=organizationalUnit)
> > >
> > > With this example the constrained attribute is the same like the one
> > > used in the LDAP URL. Now how are entries handled which are search
> > > results of the LDAP URL? In this example how to deal with new values of
> > > attribute 'ou' in case of adding a new entry with object class
> > > 'organizationalUnit'?
> > I would expect the source data for the constraint to reside in a
> > separate DIT, outside the constraint overlay's control.
>
> IMO this would be a rather awkward requirement.

IMO this would be a rather awkward configuration in the first place. Store the 
source data in some other attribute...

--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP     http://www.openldap.org/project/