Re: [ldapext] why posixAccount MUST contain 'cn'?

Usually see only one value in GECOS.
Most of the ones we deal with are when we are doing conversions from NIS or
NIS+.

Sometimes it is used to hold the employeeNumber or something unique and
static to the organization.
Using multiple values which are derived from other LDAP attributes is more
difficult as some mechanism must be used to maintain the "duplicate" GECOS
value(s).

ᐧ

--
-jim
Jim Willeke

On Tue, Dec 16, 2014 at 5:11 PM, Michael Ströder <michael@stroeder.com>
wrote:
>
> Charlie,
>
> Charlie wrote:
> > Michael asked,  "Also what's the distinction of 'cn' and 'gecos' in
> > 'posixAccount'?  It seems most NSS LDAP clients use attribute 'cn' as
> > gecos field today."
>
> Ah, someone answers my original question! Thanks! :-)
>
> > Today the GECOS field is subfielded, holding multiple data items,
>
> Frankly I never saw more things like the user's full name put in the GECOS
> field or a short description for a demon's system account. My personal
> usage
> of finger is 17+ years ago.
>
> > I have never seen an LDAP implementation where GECOS and CN were
> > synonymous.
>
> Hmm, one can only have either LDAP attribute 'cn' or 'gecos' appearing as
> passwd's GECOS field.
>
> Anyway this is one more reason to question whether posixAccount (or a
> future
> object class serving the same purpose) should have 'cn' (or similar name
> attribute) as mandatory attribute.
>
> In one of my recent setups the NSS LDAP clients can't even read 'cn' or
> 'gecos'. So "getent passwd" will simply return an empty GECOS field. The
> system admins are supposed to use LDAP client to find out more about a
> user's
> account. Yes, it's a paranoid setup.
>
> Ciao, Michael.
>
>
> _______________________________________________
> Ldapext mailing list
> Ldapext@ietf.org
> https://www.ietf.org/mailman/listinfo/ldapext
>
>