[python-ldap] Attribute syntax definitions

[Michael Ströder]

Nyasha Chigwamba wrote:
> On Mon, Dec 3, 2012 at 11:12 PM, Michael Ströder <michael at stroeder.com
> wrote:
>     How generic should this be?
> 
> At the moment, I am only creating instances of a single object class that is
> defined on the server. Eg. In my AD server, I can create an instance of the
> user class. The inheritance hierarchy of the user class contains (person,
> organizationalPerson, top). I do not support multiple inheritance but it might
> become a requirement. Multiple inheritance being, for example, creating a
> instance of the user class that also inherits from the account class.

Fortunately ldap.schema already does all that for you:

http://www.python-ldap.org/doc/html/ldap-schema.html#ldap.schema.subentry.SubSchema.attribute_types

I know that ldap.schema is not documented very well. Doc contributions welcome...

>     Note that DIT content rules also influence the set of attributes usable in an
>     entry. Some developers of a widely used LDAP client blame MS AD for not having
>     LDAPv3 compliant subschema but they fail to evaluate the DIT content rules...
> 
> I also discovered that I got a larger set of  attributes when I included the
> ditContentRules in my result attributes. However, I noticed that
> ditStructureRules are not return by Active Directory (optional as per relevant
> RFC)

AD does not have DIT structure rules and name forms.
AD extensively uses DIT content rules though.

>     'subschemaSubentry' is an operational attribute in every entry. Bear in mind
>     that each part of the DIT could have its own subschema.
> 
> Do you mean in contexts where, for example, referrals are used? 

Nothing about referrals.

If you want to implement a really schema-aware client this client has to query
the subschema subentry for each entry! web2ldap does that except when
displaying search results. Schema caching is needed to let this scale.

> It would be great if I can support all LDAP servers.  

Good luck! It's gonna be much work.

Ciao, Michael.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://mail.python.org/pipermail/python-ldap/attachments/20121212/936d1483/attachment.bin>