Re: "LDAP ease modify restrictions" support

[Radovan Semancik <radovan.semancik@evolveum.com>]

On 02/20/2016 04:17 PM, Michael Ströder wrote:
> The control's OID is listed in my OpenLDAP 2.4.44 instance. 

Thanks. I'll try that once I find Ubuntu packages of recent OpenLDAP 
version ... that'll take a bit of time :-)

> BTW: I'd always recommend to fix the client instead of using this control.

Actually, that's not really a practical advice.

LDAP does not have ACID consistency. Adding a value that is already 
added may happen even if everything operates correctly and there is no 
bug in the client code.

E.g. imagine that two clients adds user to the same group. If the 
control is not present, one of the operations fails even if there is 
actually no logical error at all. Reading a value, filtering out the 
values and writing it again provides no guarantees, as the value might 
be changed in the meantime. Yes, the clients may have special handling 
for this error and evaluate the case and re-try the operation. In a way 
similar to handling of optimistic lock conditions. But that is at least 
one extra round-trip. Usually two. And this significantly complicates 
the client code as the operation may add a couple of values and remove 
other values. It is possible to write a correct code to handle that (we 
have done that in midPoint), but it is not easy to develop and 
(especially) test it. It is not something that one would expect from an 
ordinary LDAP client, is it?

--
Radovan Semancik
Software Architect
evolveum.com