Re: [ldapext] DBIS - new IETF drafts

[Michael Ströder <[e-mail]>]

Simo wrote:
> On Thu, 2014-01-09 at 21:45 +0100, Michael Ströder wrote:
>> Simo wrote:
>>> On Thu, 2014-01-09 at 19:08 +0100, Michael Ströder wrote:
>>>> Simo wrote:
>>>>> The full schema definitions can be found here:
>>>>> https://git.fedorahosted.org/cgit/freeipa.git/tree/install/share/60basev2.ldif
>>>>
>>>> Looked at the schema:
>>>>
>>>> I'm a bit confused by some object classes directly referencing MAY memberOf.
>>>> 'memberOf' is normally an operational attribute also in 389 DS isn't it?
>>>
>>> It is a generated by the memberof plugin, it's semantics are different
>>> from other solutions (like AD), all descendants are resolved at modify
>>> time.
>>
>> Really different semantics?
>>
>> AFAIK memberOf should be a simple back-link from the member's entry to the
>> group entry. When the attribute value is actually created (on modify or on
>> read) is not relevant for memberOf semantics. Or did I get you wrong?
> 
> It is not a backlink in FreeIPA.
> 
> If you have:
> groupA:
>    member: GroupB
> 
> groupB:
>    member: userC
> 
> then userC's memberof is:
> 
> userC:
>   memberOf: groupA
>   memberOf: groupB
> 
> This makes initgroups a lot more efficient as it is a single dereference
> search to get all groups a user directly or indirectly belongs to.

(Sigh!) You took the attribute type NAME and OID from MS AD:

( 1.2.840.113556.1.2.102
  NAME 'memberOf'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
  NO-USER-MODIFICATION )

But you've changed the semantics. In AD 'memberOf' does not(!) include nested
group membership.

That's really bad practice and makes client developers live really miserable!

Ciao, Michael.