Re: [ldapext] DBIS - new IETF drafts

[Michael Ströder <[e-mail]>]

Mark R Bannister wrote:
> Yes as you'll see from my recent reply to Simo, the case sensitivity issue was
> one of the problems I faced at a large installation,

This could be easily solved with RFC2307bis. Or not?

In my deployments I simply define additional (OpenLDAP) constraints for those
attributes (e.g. to enforce lower-case 'uid' values).

IMHO only re-defining the matching rules does not fully solve the case problem
anyway. Restricting to lower-case attribute values helps better.

> It seemed quite strange to me that
> RFC2307 should have differed like this from NIS in the first place.

We all agree that RFC 2307 - even though widely deployed - has serious issues.

> Yes this was another aspect I wanted to simplify.  RFC2307bis does not make it
> easy to express group membership.

What does "express group membership" mean exactly?

> Nested groups are very important especially in large enterprises, and really
> do assist with data management.

I am always getting told this but I have strong doubts about nested groups.

>  Yes we'll get more search operations, but I
> don't think this will be a problem.  I should be able to prove this will work
> in my reference implementation.

Resolving nested group membership is a big performance cost. I can see this
with a MS Sharepoint installation working with a OpenLDAP server. Sharepoint
sends many search requests even though nested groups are not used in this
deployment.

Also nested groups are a pain if you want to report all effective user rights
to auditors (which is something banks have to do at least once per year). In
this context even maintaining the group membership does not look that simple
anymore.

Ciao, Michael.