Michael Karrer wrote:
Hello List,
is there a way to limit (filter) the target entries of a CoS?
For classic cos, apart from its natural filtering for cos class and
schema checking (you know cos checks schema before supplying attributes
right?), you could make the cos depend on roles by using the nsrole
attribute to determine class - this is called role based attributes.
Then you can determine the cos by any method available to roles,
including ldap filters.
(We are planing to integrate a Adress Book with companies and Sub
companies but the Cos should only be active for one level and not down
to the bottom)
There is currently no innate ability to limit the depth of scope for
either cos or roles. However, here's a trick you could employ to limit
roles to one level which when combined with role based attributes should
get you what you need. Determine the filter you require for your dynamic
role, request the entryid attribute from the parent of the target
entries, then modify the filter like so:
(&(parentid=<the entryid from above>)(<your original filter>))
Note that this is not infallible, entryids are unique only within the
backend instance so if there happens to be another entry in another
backend that has children and the same entryid, then those children
would be effected too.
--
Pete