Re: [ldapext] Case sensitivity summary

[Michael Ströder <[e-mail]>]

Simo Sorce wrote:
> On Fri, 2015-12-04 at 15:00 +0100, Michael Ströder wrote:

>> Regarding service names:
>>
>> (Personally I never saw any customer LDAP deployment storing a services map.)
>>
>> 1. Service names are used in DNS RRs (SRV, DANE, etc.) and those DNS labels are
>> definitely supposed to be treated case-insensitive.
> 
> There are odd things in the wild, so you need to be at least
> case-preserving, both for user names and services.

I concur with case-preserving.  But EQUALITY matching rule (which also enforces
uniqueness) should be case-insensitive.

>> 2. Jordan pointed out RFC 6335.
>>
>> => I concur with Jordan: Service names MUST be treated case-insensitive.
>> Probably recommending in an implementation note to normalize values to
>> lower-case seems also to be a good idea.
>>
>> => People actually using case-sensitive service names to address *different*
>> services MUST clean up their local mess. But they likely have to do that anyway.
> 
> ACK, maintaining broken systems may seem the only way for some
> organizations due to the daunting task and inter-dependencies that makes
> a clean up really hard. I have personally witnessed herculean efforts to
> migrate several hundreds diverged NIS domains into a single directory,
> and it ain't pretty. Especially if you have terabytes of data and
> numerous files with permissions to deal with. But the problem has always
> mostly been on uidNumber and gidNumber consolidation, usually
> name-mismatches have been mush easier to deal with because it is easy to
> remap usernames locally.

In those cases I tend to recommend to simply keep different LDAP server deployments.

Ciao, Michael.