On Wed, 3 Jun 2009, tamarin p wrote: > Hi, > > i apologize that i am revisiting this topic yet again but as we found out, > double quoted distinguished names are no longer possible in 1.2.0. We > initially discovered the problem for the aliasedobjectname class but it > later turned out its a fault with double quoted dns in general and the > schema violation we got for aliasedobjectname was because a doublequoted dn > always leads for some bizare reason to the creation of an attribute with the > double quoted part as the attr/value pair, so the schema violation was > effect rather than cause.. we are also fairly certain they worked prior to > this as we initially did some tests with 1.1.0, 1.1.2 and 1.1.3 without > encountering into any problems with this. > > I was told in another thread that the double quoted syntax is deprecated and > that escapes should be used instead. Is it then safe to assume that double > quoted style will not be fixed (or at least have extremely low priority)? We > have some clients who sometimes give us LDIFs for adding to the directory > and they prefer the double quoted syntax as more easily readable. I can > write convert script for them easily enough to handle the obvious cases but > I won't go through the effort if there is a chance this will be fixed one > minor version down the road. I just ran into the same problem, actually, and found one of your old mailing list posts on it; I'd been meaning to ask about it on the mailing list, so thanks for reminding me. :) The ns-newpwpolicy.pl script creates double-quoted DNs, which are then impossible (AFAICT) to modify. In other words, if you follow the documented procedure for creating per-user or per-subtree password policies, it doesn't work because the policy container is created with a double-quoted DN. In addition to the OP's question, what's the Right Thing to do with password policies? Will it work if I create the policy containers by hand with the hex escape syntax? Or do I need to create them by hand and populate them at creation time (since it's apparently still possible to _add_ entries with double-quoted DNs, just not modify them), and delete-and-recreate if I need to modify my policy? Thanks! Chris St. Pierre Unix Systems Administrator Nebraska Wesleyan University
