diff --git a/CHANGES b/CHANGES index 2eb1186921e764e2fab1c37316d228389ea36511..0634e2894499dc22b02f206e1bdf6c64dd2dfd23 100644 --- a/CHANGES +++ b/CHANGES @@ -34,8 +34,8 @@ OpenLDAP 2.4.12 Engineering Fixed ODBC library detection (ITS#5602) Documentation Added slapd-ldap(5), slapd-meta(5) noundeffilter (ITS#5614) + Fixed slapd-ldap(5), slapd-meta(5), slapo-pcache(5) schema requirements (ITS#5680) Added slapo-retcode(5) retcode.conf location (ITS#5633) - Fixed slapd-ldap(5), slapd-meta(5) schema requirements (ITS#5680) admin24 guide updates (ITS#5616) admin24 octetString fix (ITS#5670) diff --git a/doc/man/man5/slapo-pcache.5 b/doc/man/man5/slapo-pcache.5 index 84e55d2acc6dc12e9e0268d7f42da36c70e4a602..eb2b0f5aa50fdb6a9d47665c9f2c04d2ca23c208 100644 --- a/doc/man/man5/slapo-pcache.5 +++ b/doc/man/man5/slapo-pcache.5 @@ -182,6 +182,13 @@ The remote server should expose the attribute because the underlying database that actually caches the entries may need it for optimal local processing of the queries. +The proxy server should contain all the schema information required for caching. +Significantly, it needs the schema of attributes used in the query templates. +If the objectClass attribute is used in a query template, it needs the definition +of the objectClasses of the entries it is supposed to cache. +It is the responsibility of the proxy administrator to keep the proxy schema +lined up with that of the proxied server. + Another potential (and subtle) inconsistency may occur when data is retrieved with different identities and specific per-identity access control is enforced by the remote server.