Re: [ldapext] DBIS - new IETF drafts

[Mark R Bannister <[e-mail]>]

On 09/01/2014 15:48, Michael Ströder wrote:
> Mark R Bannister wrote:
>> Yes as you'll see from my recent reply to Simo, the case sensitivity issue was
>> one of the problems I faced at a large installation,
> This could be easily solved with RFC2307bis. Or not?

Not.  It uses the 'cn' attribute for a start, which is case insensitive.

> In my deployments I simply define additional (OpenLDAP) constraints for those
> attributes (e.g. to enforce lower-case 'uid' values).

Hard to do with 'cn'.  We had to invent a new custom attribute to 
replace 'cn' with.

> IMHO only re-defining the matching rules does not fully solve the case problem
> anyway. Restricting to lower-case attribute values helps better.
>
>> It seemed quite strange to me that
>> RFC2307 should have differed like this from NIS in the first place.
> We all agree that RFC 2307 - even though widely deployed - has serious issues.
>
>> Yes this was another aspect I wanted to simplify.  RFC2307bis does not make it
>> easy to express group membership.
> What does "express group membership" mean exactly?

"Express", meaning, to put into words.

>
>> Nested groups are very important especially in large enterprises, and really
>> do assist with data management.
> I am always getting told this but I have strong doubts about nested groups.

If you're always getting told this, then there must be lots of people 
who like nested groups.  If people like it, then it's in demand.

>
>>   Yes we'll get more search operations, but I
>> don't think this will be a problem.  I should be able to prove this will work
>> in my reference implementation.
> Resolving nested group membership is a big performance cost. I can see this
> with a MS Sharepoint installation working with a OpenLDAP server. Sharepoint
> sends many search requests even though nested groups are not used in this
> deployment.

Caching will improve the situation.  Yes there is a performance cost.  
So what?  Don't innovate if it takes CPU cycles?

> Also nested groups are a pain if you want to report all effective user rights
> to auditors (which is something banks have to do at least once per year). In
> this context even maintaining the group membership does not look that simple
> anymore.
>

Not if you come up with the good tools to help you search and visualise 
the nested structures.

Best regards,
Mark.