Fix compare op

[openldap] / servers / slapd / schema / dyngroup.schema

diff --git a/servers/slapd/schema/dyngroup.schema b/servers/slapd/schema/dyngroup.schema
index 33eb1e26b8ef9d3241cbebd0d33cb3e0af483e1b..cc962b73e44d6bc016f6acb8af91799a993d1a5f 100644 (file)
--- a/servers/slapd/schema/dyngroup.schema
+++ b/servers/slapd/schema/dyngroup.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2007 The OpenLDAP Foundation.
+## Copyright 1998-2009 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without
@@ -14,8 +14,11 @@
 ## <http://www.OpenLDAP.org/license.html>.
 #
 # Dynamic Group schema (experimental), as defined by Netscape.  See
-# http://enterprise.netscape.com/docs/enterprise/60/admin/esusrgrp.htm#1019520
-# for details.
+# http://www.redhat.com/docs/manuals/ent-server/pdf/esadmin611.pdf
+# page 70 for details on how these groups were used.
+#
+# A description of the objectclass definition is available here:
+# http://www.redhat.com/docs/manuals/dir-server/schema/7.1/oc_dir.html#1303745
 #
 # depends upon:
 #      core.schema
@@ -23,7 +26,25 @@
 # These definitions are considered experimental due to the lack of
 # a formal specification (e.g., RFC).
 #
-# Not recommended for production use!  Use with caution!
+# NOT RECOMMENDED FOR PRODUCTION USE!  USE WITH CAUTION!
+#
+# The Netscape documentation describes this as an auxiliary objectclass
+# but their implementations have always defined it as a structural class.
+# The sloppiness here is because Netscape-derived servers don't actually
+# implement the X.500 data model, and they don't honor the distinction
+# between structural and auxiliary classes. This fact is noted here:
+# http://forum.java.sun.com/thread.jspa?threadID=5016864&messageID=9034636
+#
+# In accordance with other existing implementations, we define it as a
+# structural class.
+#
+# Our definition of memberURL also does not match theirs but again
+# their published definition and what works in practice do not agree.
+# In other words, the Netscape definitions are broken and interoperability
+# is not guaranteed.
+#
+# Also see the new DynGroup proposed spec at
+# http://tools.ietf.org/html/draft-haripriya-dynamicgroup-02
 
 objectIdentifier NetscapeRoot 2.16.840.1.113730
 
@@ -31,14 +52,40 @@ objectIdentifier NetscapeLDAP NetscapeRoot:3
 objectIdentifier NetscapeLDAPattributeType NetscapeLDAP:1
 objectIdentifier NetscapeLDAPobjectClass NetscapeLDAP:2
 
+objectIdentifier OpenLDAPExp11 1.3.6.1.4.1.4203.666.11
+objectIdentifier DynGroupBase  OpenLDAPExp11:8
+objectIdentifier DynGroupAttr  DynGroupBase:1
+objectIdentifier DynGroupOC    DynGroupBase:2
+
 attributetype ( NetscapeLDAPattributeType:198
        NAME 'memberURL'
        DESC 'Identifies an URL associated with each member of a group. Any type of labeled URL can be used.'
        SUP labeledURI )
 
+attributetype ( DynGroupAttr:1
+       NAME 'dgIdentity'
+       DESC 'Identity to use when processing the memberURL'
+       SUP distinguishedName SINGLE-VALUE )
+
+attributeType ( DynGroupAttr:2
+       NAME 'dgAuthz'
+       DESC 'Optional authorization rules that determine who is allowed to assume the dgIdentity'
+       EQUALITY authzMatch
+       SYNTAX 1.3.6.1.4.1.4203.666.2.7
+       X-ORDERED 'VALUES' )
+
 objectClass ( NetscapeLDAPobjectClass:33
        NAME 'groupOfURLs'
        SUP top STRUCTURAL
        MUST cn
        MAY ( memberURL $ businessCategory $ description $ o $ ou $
                owner $ seeAlso ) )
+
+# The Haripriya dyngroup schema still needs a lot of work.
+# We're just adding support for the dgIdentity attribute for now...
+objectClass ( DynGroupOC:1
+       NAME 'dgIdentityAux'
+       SUP top AUXILIARY
+       MAY ( dgIdentity $ dgAuthz ) )
+
+