OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: LDAP v3 and dereference request advice needed

From: Alain NAKACHE (alainalinto.net)
Date: Fri Sep 30 2005 - 09:52:49 CDT


Victor Duchovni wrote:

>On Fri, Sep 30, 2005 at 12:09:34PM +0200, Alain NAKACHE wrote:
>
>
>
>>search_base = ou=emails,domain=%d,o=example.com
>>query_filter = (&(mail=%u*)(status=1))
>>result_attribute = mail
>>
>>
>
>The "*" is a bad idea, if the location in the tree implies the domain,
>then implement in each LDAP entry an attribute that holds just the
>unqualified local-part of the address:
>
> localpart: joeuser
> mail: joeuserexample.com
> status: 1
>
>
>
Good advice. Queries will surely be faster.

>Change the query to search on the local-part attribute:
>
> search_base = ou=emails,domain=%d,o=example.com
> query_filter = (&(localpart=%u)(status=1))
> result_attribute = mail
>
>
>
ok

>Pick a suitable attribute name if you don't like "localpart", I offer
>no advice on which schema may or may not contain an appropriate attribute
>this is not of concern to the Postfix community (or at least to me :-).
>
>
>
it will be named "userpart" or "joepart" :-)

>The tradeoff is between economy of expression (just one entry for a
>domain alias vs. one for each user with a mailbox in equivalent domains)
>and ease of transitions. Later when you want to phase out a domain you
>will not be able to drop it gradually one user at a time, or to stop
>provisioning it for new users implicitly.
>
>I usually err on the side of flexibility (even if the tools are a bit more
>complex), let machines do the hard work of populating the redundant data,
>but retain the freedom to make it non-redundant when the policy from
>being universal to applying to just a shrinking set of legacy addresses.
>

I know it is little off-topic but in terms of performance or
portability, is the LDAP (reference) alias a good choice ?