Re: Net::LDAP::schema brokenness

[Clif H. <cl...@di...>]

> 
> It is widely known that the Root DSE subschema mechanism described
> in RFC 2251 is seriously broken.  This approach should be avoided.
> (I suspect this approach to be eliminated from the specification).
> 
> If you want discover the subschema controlling a particular
> entry, obtain the subschema from the DN contained in that entry's
> subschemaSubentry attribute.  If adding an entry, fetch the schema


This is where part of the problem lies, according to RFC 2251 
3.2.1 subschemaSubentry is a MAY contain attribute.  Many directory 
servers do not use subschemaSubentry, whether this is right or wrong 
engineering practice does not matter because it is legal according 
to the RFC.

Maybe someone should work with the IETF to make subschemaSubentry a 
MUST contain attribute.  Personally I think it should be a MUST contain
attribute.


> controlling the entry's parent to be.  This approach should work on
> all LDAPv3 servers implementing subschema discovery.
> 
> I note that the IETF LDAPbis WG is working on a revision of
> the LDAPv3 specification.  I encourage all those interested
> in producing an LDAPv3 Draft Standard to get involved.
>   http://www.ietf.org/html.charters/ldapbis-charter.html
> 
> 


Regards,

Clif Harden      c-h...@ti...