On 5/2/07, Ersin Er <ersin.er@gmail.com> wrote:

Bringing this mail again to your attention. Please let me know is
there is any pb.

OK more in line ...

So, now, regarding to subtreeSpecification related components in ACIs.

So these are the subterms in the perscriptiveACI attribute syntax and not
the subtreeSpecification attribute in the ACI subentry.  This I think is where
the confusion lies. 

What I am saying is the subtreeSpecification attribute in the ACI subentry
supports refinements using the full LDAP filter which you extended.  However
the inner elements for classes and subtree inside the prescriptiveACI do not.

This is what I would like to clarify.

They have not been effected by this change because they cannot be and
we did not want also.

Can you explain why we should not do this? 

There are two components that may come to mind
about this change. First is the "classes" protected item and the
second one is "subtree" user class. The "classes" protected item has
the refinement syntax and it is really used for specifying a boolean
combination of object classes. It can never include regular attributes
other than object class values.

I know X.500 syntax does not allow it but what prevents us from extending
it as well to use the full LDAP filter instead?  Just curious btw and not suggesting
that we do it.