Re: [ldapext] Case sensitivity summary

[Andrew Findlay <[e-mail]>]

On Fri, Dec 04, 2015 at 10:40:10AM -0500, Simo Sorce wrote:

> There are odd things in the wild, so you need to be at least
> case-preserving, both for user names and services.

One idea that I did not put in the summary as it is a bit of a
side-issue:

Client systems that care about case-sensitivity might be given a config
option to use extensible matching:

ldapsearch -x '(&objectclass=posixAccount)(uid:caseExactMatch:=BABS))'
ldapsearch -x '(&objectclass=posixAccount)(uid:caseExactMatch:=babs))'

It would then be possible to have two entries where the uid differs only
in case provided uid is not used as the RDN attribute. This SHOULD
prevent either user from logging in on systems that are not using the
search shown above, as the result of a normal search on uid would be
ambiguous. Data management would require great care.

> ACK, maintaining broken systems may seem the only way for some
> organizations due to the daunting task and inter-dependencies that makes
> a clean up really hard. I have personally witnessed herculean efforts to
> migrate several hundreds diverged NIS domains into a single directory,
> and it ain't pretty. Especially if you have terabytes of data and
> numerous files with permissions to deal with. But the problem has always
> mostly been on uidNumber and gidNumber consolidation, usually
> name-mismatches have been mush easier to deal with because it is easy to
> remap usernames locally.

People are often tempted to build complex technical solutions because
that is within their control and ability. It is almost always better in
the long run to fix the organisational issues and migrate to a clean(er)
set of data using a simpler technical setup.

Anyone can make an existing system more complex. It takes effort and
clear vision to make it simpler.

Andrew
-- 
-----------------------------------------------------------------------
|                 From Andrew Findlay, Skills 1st Ltd                 |
| Consultant in large-scale systems, networks, and directory services |
|     http://www.skills-1st.co.uk/                [phone]     |
-----------------------------------------------------------------------