[389-users] CoS usage

Hi,

I have 389 DS (1.2.10.7 version)
I am getting confusing ldapsearch results when I use two classic CoS entries defined under
the same subtree in order to have the subtree accounts assigned with one of two different
values of a shared/generated attribute  - in my case  pwdpolicysubentry attribute.

I want to point out that a mechanism of generating shared attributes by both CoS entries
work as expected and that I defined them via bash script and not over 389 Management
Console or ns-newpwdpolicy.pl script(they both work with pointer CoS and I needed classic
CoS).
Also, all generated attributes are  visible in the Console. This is also ok.

In the first test, I  had in both CoS's definition entries (I will mark them here as
1) and 2) ) the "operational-default" qualifier:
cosattribute: pwdpolicysubentry  operational-default.

Hence, I expected that the below search would not return any of the entries with generated
attributes... but it did -all of them.
(Entries were returned without generated attributes: this is OK as pwdpolicysubentry is an
operational attribute)

# ldapsearch -x -ZZ -h localhost -D "cn=directory manager" -b
"ou=people,dc=example,dc=com" -w secret -s
sub "(pwdpolicysubentry=*)" "*"

I got the same result when in both 1) and 2) a qualifier was just
                    cosattribute: pwdpolicysubentry  operational
that I consider as correct.

When I modified 1) and 2)  CoS definition entries to be:
                cosattribute: pwdpolicysubentry
the ldapsearch returned none of them, but only an entry that has pwdpolicysubentry of its
own.
Nothing changed when I put  "default" qualifier explicitly.
What I expected was to return all entries - those with their own pwdpolicysubentry and the
others (with the generated one). (In my example, entries with generated attributes do not
have their own attributes).

Finally, and the most confusing case:

1)       cosattribute: pwdpolicysubentry
while in

2)      cosattribute: pwdpolicysubentry operational
returned them all as if the qualifier in  2) have  impact on CoS 1) qualifier (?!)

Do you know if my version(1.2.10.7) of the server has any bug related to CoS definitions
or I am something wrong?
If you need more information, please ask.

Thank you,
Jovan Vukotic