Subject: LDAP subtree search with zero-length DN for baseObject?

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Thu, 10 Feb 2000 09:43:42 -0800 (PST)

RFC 2251 says, in section 3.4:

   An LDAP server MUST provide information about itself and other
   information that is specific to each server.  This is represented as
   a group of attributes located in the root DSE (DSA-Specific Entry),
   which is named with the zero-length LDAPDN.  These attributes are
   retrievable if a client performs a base object search of the root
   with filter "(objectClass=*)", however they are subject to access
   control restrictions.  The root DSE MUST NOT be included if the
   client performs a subtree search starting from the root.

It isn't clear to me, though, what the expected result should be from a
subtree search where the baseObject is the zero-length DN.  It mustn't
include the root DSE info, but what should it include?  Should this mean
"the subtree rooted at root of the global DIT"?  Presumably, if so, in
existing cases this would typically fail since the DSA doesn't know how to
contact a DSA for "the root".  Or can a DSA interpret it as "search all
the naming contexts you have locally?"  By experiment I find that servers
I've tried this on report "no such object".

Thanks,

 - RL "Bob"

---

From: Mark Wahl <[email-masked]>
Date: Thu, 10 Feb 2000 12:18:50 -0600

I can tell you what at least one implementation does in the case of a 
search that is not baseObject and the base name is zero length:

 1) If the server is configured to hold ALL naming contexts immediately 
   subordinate to the root (it is a top level server), then it searches 
   each of these naming contexts that are immediately subordinate to the
   root, and any subordinate contexts as normal.  

 2) If the server is configured with a superior reference, then it returns
    a referral.

 3) Otherwise it returns an error such as noSuchObject.

Mark Wahl, Directory Product Architect
Innosoft International, Inc.

---

From: Helmut Volpers <[email-masked]>
Date: Sun, 13 Feb 2000 14:36:48 +0100

I have seen a lot of simple clients which doesn't read the root
to get information about the server. They make a subtree search with
root 
as base object and they can live with a result which doesn't include the 
root but all the local entries in the server which match the filter.

So for a standalone server you can configure ROOT as CP in our DSA and
you 
can use root as base in every search. The root is only returned
in a base-level search (read).
In all the other cases we use the modell that the name resolution 
is finished and "search all the naming contexts you have locally" plus
referralls to all the references the server holds.

Can all your LDAP enabled applications can work with "noSuchObject"
for a search with ROOT as BaseObject ?

Helmut