Re: [ldapext] Schema for posixGroup successor (RFC 2307 bis)

[Andrew Findlay <[e-mail]>]

On Wed, Feb 11, 2015 at 10:58:31AM +0100, Michael Ströder wrote:

> To preserve backwards compability I'd like to propose the following:
> 
> ( <OID TBD>
>   NAME 'posixGroup2'
>   DESC '<TBD>'
>   SUP ( groupOfEntries $ posixGroup )
>   STRUCTURAL )

That's a very cunning plan, but I am not sure that it will work...

> 1. posixGroup2 would have 'member' and 'memberUID' both as optional attributes,

That depends on exactly how multiple inheritance works. The only
definition I have found so far is in RFC4512:

      An object class may be derived from two or more direct
      superclasses (superclasses not part of the same superclass chain).
      This feature of subclassing is termed multiple inheritance.

   Each object class identifies the set of attributes required to be
   present in entries belonging to the class and the set of attributes
   allowed to be present in entries belonging to the class.  As an entry
   of a class must meet the requirements of each class it belongs to, it
   can be said that an object class inherits the sets of allowed and
   required attributes from its superclasses.  A subclass can identify
   an attribute allowed by its superclass as being required.  If an
   attribute is a member of both sets, it is required to be present.

Thus I think that your new class would have *more* mandatory
attributes than either of its superiors:

	MUST ( member $ cn $ gidNumber )

Not quite the point as we really want member to be optional.

> 2. the object class still can be found with (objectClass=posixGroup) and

I like that bit!

> 3. the object class is STRUCTURAL and therefore one can assign a specific DIT
> content rule to it allowing to preclude either 'member' or 'memberUID' with
> NOT to meet local system requirements.

+1

Looking through the common schemas it seems that multiple inheritance
is extremely rare, so I wonder whether all servers would even agree on
how it works...

Andrew
-- 
-----------------------------------------------------------------------
|                 From Andrew Findlay, Skills 1st Ltd                 |
| Consultant in large-scale systems, networks, and directory services |
|     http://www.skills-1st.co.uk/                [phone]     |
-----------------------------------------------------------------------