I see that openldap supports a number of matching rules for DNs,
e.g. dnOneLevelMatch, dnSubtreeMatch, dnSubordinateMatch and
dnSuperiorMatch.
Please can someone point me to documentation about these matching
rules? (Google doesn't seem to bring up much useful).
RFC 4517, section 4.
Thanks, but I don't see anything about these matching rules in
Rfc4517 section 4.
Substring assertion is discussed in section 3
I'm not trying to awkward, but I don't see how that relates to my question.
I understand how to use the matching rules syntactically, but
I have not found documentation anywhere that describes how these matching rules work.
I can try out examples and/or read the openldap source code to try and deduce their behaviour, but I'd
prefer to see documentation.
I have done some more investigation and experiments, and this is what I've found:
1. there is no documentation that I can find online defining the behaviour of the matching rules dnOneLevelMatch, dnSubtreeMatch, dnSubordinateMatch and dnSuperiorMatch.
2. these matching rules are mentioned here: http://www.openldap.org/faq/data/cache/1101.html, and all have OIDs under 1.3.6.1.4.1.4203.666.
3. this page http://www.openldap.org/faq/data/cache/200.html, which describes OID 1.3.6.1.4.1.4203.666 says "OpenLDAP Experimental OIDs are assigned to protocol items with an evolving specification (e.g., a work in progress) under development by the OpenLDAP Project. The specification can be revised without assigning a new OID.
No released software should use an OID under this arc."
4. an example using dnSubtreeMatch is given in the slapcat(8) man page, which seems to imply that these matching rules are no longer experimental.
5. from experiment I think I understand the behaviour of these matching rules, but that is not ideal:
(a) A filter like (entrydn:dnOneLevelMatch:=<targetdn>) restricts the result to entries 1 level subordinate to targetdn.
(b) (entrydn:dnSubtreeMatch:=<targetdn>) restricts the result to the subtree including and under targetdn
(c) (entrydn:dnSubordinateMatch:=<targetdn>) restricts the result to the entries subordinate to targetdn (i.e. the same as dnSubtreeMatch, but excluding the targetdn)
(d) (entrydn:dnSuperiorMatch:=<targetdn>) restricts the result to the entries superior to targetdn