Re: Net::LDAP::schema brokenness

[Chris R. <chr...@me...>]

Clif Harden <cl...@di...> wrote:
> IMO if cn=schema is broken, it has the strange habit of returning correct 
> data.

I think it is very much a quick hack for a specific server. There's nothing
in *any* RFC requiring subschema to be stored at <cn=schema>. Perhaps some
other servers are trying to be compatible with the first server that used
<cn=schema>. I insist (!) that it is a fluke that it works for you :-)

> I believe the RFC states MAY contain a subschemaSubentry attribute.

Well, section 3.4 of RFC 2251 says "If the server masters directory entries
under one or more schema rules, there may be any number of values of the
subschemaSubentry attribute in the root DSE.". Since you can't have an
attribute with zero values, I would read this as saying the attribute may
have more than one value. But this is arguable.

(Also note the direct conflict between this part of 2251 and 2252 section
5.1.5, the former says the attribute called subschemaSubentry is
multi-valued, and the latter where it says the subschemaSubentry is
single-valued. Both interpretations make sense in their own context, but
unfortunately the RFC editors chose the same name for both attributes.)

It definitely isn't the best way to locate any subschema held on a server.

Cheers,

Chris