[389-users] Re: 389ds and Get Effective Rights control: neither entryLevelRights nor attributeLevelRights returned
On 18 Nov 2019, at 22:27, Graham Leggett <minfrin(a)sharp.fm>
wrote:
On 18 Nov 2019, at 03:05, William Brown <wbrown(a)suse.de> wrote:
>> I tried that, but it made no difference. I also noticed that despite asking for
attributes “*” and “+”, the java code didn’t give me any operational attributes back at
all.
>>
>> I’m assuming that entryLevelRights/attributeLevelRights are operational
attributes and 389ds won’t return them with a “*” attribute on it’s own?
>
> The attributes you "request" are the attributes it will do an effective
rights check on, and the server just "puts" the *rights attributes in your
response without asking (well, you did ask because of the control)
>
>>
>> I’m trying to work out whether this is a java issue or a 389ds issue.
>
> Why not both?
Possibly - I eventually found that elsewhere in my code I was silently stripping any
attribute that came back that didn’t have a schema, and these explained why
entryLevelRights/attributeLevelRights were missing, but not why operational attributes had
no schemas.
This leads to the issue of how do we find the syntax OIDs for operational attributes? Are
these made available by 389ds in some way, or does the calling code have to know how to
handle each type of operational attribute?
You should be able to search and parse cn=schema remotely to see what the server is
offering attribute type wise
Regards,
Graham
—
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
—
Sincerely,
William Brown
Senior Software Engineer, 389 Directory Server
SUSE Labs