From 1ce27eea6ee858b0bc8e1c4323b94c0a6933a493 Mon Sep 17 00:00:00 2001 From: Pierangelo Masarati Date: Tue, 8 Jan 2013 19:50:33 +0100 Subject: [PATCH] clarification about filtering for dynamically added attrs (ITS#7486) --- doc/man/man5/slapo-dynlist.5 | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/doc/man/man5/slapo-dynlist.5 b/doc/man/man5/slapo-dynlist.5 index 1a8b4f07bf..fe544d5ff0 100644 --- a/doc/man/man5/slapo-dynlist.5 +++ b/doc/man/man5/slapo-dynlist.5 @@ -12,16 +12,23 @@ The overlay to .BR slapd (8) allows expansion of dynamic groups and more. -Any time an entry with a specific objectClass is being returned, -the LDAP URI-valued occurrences of a specific attribute are +Any time an entry with a specific objectClass (defined in the overlay configuration) is being returned, +the LDAP URI-valued occurrences of a specific attribute (also defined in the overlay configuration) are expanded into the corresponding entries, and the values of the attributes listed in the URI are added to the original entry. No recursion is allowed, to avoid potential infinite loops. + +Since the resulting entry is dynamically constructed, +it does not exist until it is constructed while being returned. +As a consequence, dynamically added attributes do not participate +in the filter matching phase of the search request handling. +In other words, \fIfiltering for dynamically added attributes always fails\fP. + The resulting entry must comply with the LDAP data model, so constraints are enforced. For example, if a \fISINGLE\-VALUE\fP attribute is listed, -only the first value results in the final entry. +only the first value found during the list expansion appears in the final entry. The above described behavior is disabled when the \fImanageDSAit\fP control (RFC 3296) is used. In that case, the contents of the dynamic group entry is returned; -- 2.39.2