Norman Gray wrote: > > Howard, hello. > > On 8 Feb 2024, at 15:07, Howard Chu wrote: > >>> Norman Gray wrote: >>> >>> Howard, hello. >>> >>> On 8 Feb 2024, at 0:34, Howard Chu wrote: >>> >>>> 65c3df21.21fc2a30 0x16cacf000 >>>> ldap_url_parse_ext(ldap:///ou=groups,o=example?member?sub?(|(cn=ldap-admins-*)(cn=ldap-techs))) >>>> >>>> The above URL is not valid for a dynamic group. The attrs portion of the >>>> URL must be empty. >>>> >>>> Since it's invalid, after it is parsed it gets ignored. >>> >>> That's true when constructing what slapo-dynlist(5) calls a dynamic >>> group, but that's not what I'm constructing here, but instead a group >>> entry which is dynamically expanded, to a group, by a search. >> >> Whatever you've constructed is not a dynamic group, as defined in >> slapo-dynlist. >> As such, it is not supported for the purpose you're asking. > > Indeed -- it's not a 'dynamic group' in the terms of slapo-dynlist, but it is > an entry which has a set of 'member' attributes, which is dynamically > constructed (whatever one wants to call this). > > But I can't see that matters, since the slapd-config(5) text covering the > olcLimits configuration attribute seems to clearly indicate that > > olcLimits: > group/groupOfURLs/member="cn=ldap-operators,ou=groups,o=example" size=2 > > 'sets the limits for any DN listed in the values of the [member] attribute of > the [groupOfURLs] group whose DN exactly matches > ["cn=ldap-operators,ou=groups,o=example"]' (where [...] fills in the blanks > in the text there as I understand it). I can't see a way of interpreting > this manpage text which doesn't match this situation. This works as expected > when cn=ldap-operators is an entry which is not dynamically expanded. > > It doesn't say that that group has to be a 'dynamic group in the terms of > slapo-dynlist', it just says 'group'. > > And slapo-dynlist says: > >> Any time an entry with a specific objectClass is being returned, >> the LDAP URI-valued occurrences of a specific attribute are expanded >> into the corresponding entries, and the values of the attributes listed >> in the URI are added to the original entry.
The text above is for a *dynamic list* - which is not a *dynamic group*. The code supports groups, not lists. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/
