Re: slapo-constraint type uri: Constrained attribute used in LDAP URL

[Michael Ströder <michael@stroeder.com>]

Howard Chu wrote:
> Michael Ströder wrote:
> > Howard Chu wrote:
> > > Michael Ströder wrote:
> > > > Consider the following config for slapo-constraint in slapd.conf:
> > > >
> > > > constraint_attribute ou uri
> > > >      ldap:///o=Test Company?ou?sub?(objectClass=organizationalUnit)
> > > >
> > > > With this example the constrained attribute is the same like the one
> > > > used in the LDAP URL. Now how are entries handled which are search
> > > > results of the LDAP URL? In this example how to deal with new values of
> > > > attribute 'ou' in case of adding a new entry with object class
> > > > 'organizationalUnit'?
> > > I would expect the source data for the constraint to reside in a
> > > separate DIT, outside the constraint overlay's control.
> >
> > IMO this would be a rather awkward requirement.
>
> IMO this would be a rather awkward configuration in the first place. 
> Store the source data in some other attribute...

I guess to most people it seems quite natural to store it in the same 
attribute. So you can e.g. define departmentNumber in a user entry 
contains the very same value like the attribute departmentNumber of the 
related department entry.

Ciao, Michael.