Re: what is the best practice to modrdn for branch of objects?

> On 18 Jun 2018, at 12:33, Zeus Panchenko <[email protected]> wrote:
>=20
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>=20
> hi
>=20
> what is the best practice to moddn() for branch of objects?

I=E2=80=99m not really sure =E2=80=9Cbest practice=E2=80=9D is relevant =
here - whatever you need to do needs to be expressed in LDAP protocol =
requests.

I would note that storing entries subordinate to user entries is rather =
unusual. Not illegal in any way, just unusual and it would surprise most =
people who were familiar with LDAP.

>=20
> lets say we have two objects:
>=20
> - ---[ user A start ]-------------------------------------------
> dn: uid=3Dnaf.nafus,ou=3DPeople,dc=3Dumidb
> dn: =
[email protected],uid=3Dnaf.nafus,ou=3DPeople,dc=3D=
umidb
> dn: =
[email protected],[email protected],uid=3Dna=
f.nafus,ou=3DPeople,dc=3Dumidb
> dn: =
[email protected],uid=3Dnaf.nafus,ou=3DPeople,dc=3D=
umidb
> dn: =
cn=3Ddev-ap-notebook,[email protected],uid=3Dnaf.n=
afus,ou=3DPeople,dc=3Dumidb
> dn: =
[email protected],uid=3Dnaf.nafus,ou=3DPeople=
,dc=3Dumidb
> dn: =
[email protected],[email protected]=
tartrek.in,uid=3Dnaf.nafus,ou=3DPeople,dc=3Dumidb
> dn: =
[email protected],uid=3Dnaf.nafus,ou=3DPeople=
,dc=3Dumidb
> dn: =
[email protected],authorizedService=3Dxmpp@starfleet.=
startrek.in,uid=3Dnaf.nafus,ou=3DPeople,dc=3Dumidb
> - ---[ user A end   ]-------------------------------------------
>=20
> and
>=20
> - ---[ user B start ]-------------------------------------------
> dn: uid=3Dtaf.taffij,ou=3DPeople,dc=3Dumidb

So there are two cases to consider:

* user B already exists

* user B does not exist

In the first case, you can iterate through all of user A=E2=80=99s =
immediate children and modifydn each of them. Do you delete user A at =
the end?

Alternative in the first case, you could delete user B first and then =
just use modifydn once to move user A to user B.

In the second case, just modifydn user A to user B in a single =
operation.

You may need to refine your question a bit more.

>=20
> to do that, I take target branch subtree and =E2=80=9Ere-write=E2=80=9C =
DN of each object to be reassigned ...
> (https://github.com/z-eos/umi/blob/master/lib/LDAP_CRUD.pm#L992)
>=20
>=20
> what I think of is something like this:
>=20
> - ---[ quotation start ]-------------------------------------------
> $dn =3D =
'[email protected],uid=3Dnaf.nafus,ou=3DPeopl=
e,dc=3Dumidb';
> $mesg =3D $ldap->moddn( $dn,
>                      newsuperior =3D> =
'uid=3Dtaf.taffij,ou=3DPeople,dc=3Dumidb',
>                      recursively =3D> 1 );

Net::LDAP=E2=80=99s moddn method does not take a =E2=80=9Crecursively=E2=80=
=9D option. The LDAP modifydn operation is already defined to move all =
the entry's children. If the server cannot perform that operation, it =
will return an error instead.

Cheers,

Chris=