Subject: Re: [ldap] The correct behaviour of auxiliary object classes

From: Erik Skovgaard <[email-masked]>
Date: Wed, 01 Mar 2000 15:52:46 -0800

Vincent,

Auxiliary Object Classes are particularly useful where you want to add
attributes to several types of Structural Object Classes.

See also below.

At 14:01 2000-03-01 +0000, Vincent Ryan wrote:
>
>I'm seeking clarification of how auxiliary object classes are
>supposed to operate. My understanding of auxiliary object classes
>is that they are designed to be mixed-in with structural object
>classes when particular instances of a structural object class
>need additional attributes. 
>
>For example, 'strongAuthenticationUser' is an auxiliary class
>defined in RFC 2256 and it mandates the 'userCertificate' attribute.
>If I want to create an LDAP entry that is both an 'organizationalPerson'
>and a 'strongAuthenticationUser' then I should specify both class
>names in the object class attribute for the entry. In addition,
>as 'sn' is mandatory for the 'organizationalPerson' class and
>'userCertificate' is mandatory for the 'strongAuthenticationUser'
>class then I must supply both of these attributes too.
>
>Is my understanding correct? 

Yes, you are right.  In addition, an Auxiliary Object Class cannot be
instantiated without a Structural Object Class.

>
>Should this behaviour be stated explicitly in the LDAP RFCs?

Perhaps, but you could argue that lots of things should.  The base
documents are referenced.

>
>I notice that support for auxiliary classes in Windows 2000
>Active Directory deviates from this behaviour. Auxiliary classes
>are (permanently) associated with specific structural classes in
>the Active Directory schema. The effect is that every instance of
>a structural class must contain the mandatory attributes of all
>of its associated auxiliary classes. That is, the auxiliary class
>is associated with every instance of the structural class. In
>addition, auxiliary class names must not appear as values of the
>object class attribute of the instance of the structural class.
>
>Can someone from Microsoft confirm that my description is correct?
>(Or have I misunderstood how Active Directory operates.)
>
>Do other LDAP server implementors support auxiliary classes differently?

Some do not implement them at all.

Cheers,                   ....Erik.

--------------------------------------
Erik Skovgaard
Global Knowledge
Enterprise Directory Group
>
>---
>You are currently subscribed to [email-masked] as: [[email-masked]]
>To unsubscribe send email to [email-masked] with the word
UNSUBSCRIBE as the SUBJECT of the message.

---

From: "Brian Jarvis" <[email-masked]>
Date: Wed, 01 Mar 2000 19:47:10 -0700

Your understanding is correct.  To add an auxiliary class to an object you add it to Object Class and simultaneously add any mandatory attributes it has.  To remove an auxiliary class from an object, you delete it from Object Class.

I don't think we need to specify this behavior every place that defines an auxiliary class.  One place will be less confusing since the specifications invariably would differ.

>>> Vincent Ryan <[email-masked]> 3/1/2000 07:06:26 >>>