Pierangelo Masarati writes: > - a DN-valued attr is used; then <style> can be "exact"/"base", or > "subtree" or "children" or "one" and so on. In all of these cases a > matching rule can be specified. Maybe this is useless, because I'm afraid > that (at present) only distinguishedNameMatch can be used. I've > introduced this for symmetry, although for DN-valued attrs value_match() > is not actually invoked, but a string comparison on the normalized > relevant portion of the DN is used.
How do you imagine it would work to use both e.g. "subtree" and a matching rule? In effect base/subtree/children etc *is* the matching rule. (And one which I'd really like to have as a real matching rule to be used in extensibleMatch filters, BTW:-) > In fact, one thing that was happening before was that this ACL was > usable with those DN-valued attrs that do not define an EQUALITY rule, > which sounds like an inconsistency. Yup, it treats DNs specially by always using a scope, and the default, "base", is in practice distinguishedNameMatch. -- Hallvard
