draft-ietf-asid-ldapv3-attributes-02.txt   draft-ietf-asid-ldapv3-attributes-03.txt 
Network Working Group M. Wahl Network Working Group M. Wahl
INTERNET-DRAFT Critical Angle Inc. INTERNET-DRAFT Critical Angle Inc.
Obsoletes: RFC 1778 A. Coulbeck Obsoletes: RFC 1778 A. Coulbeck
ISODE Consortium ISODE Consortium
T. Howes T. Howes
Netscape Communications Corp. Netscape Communications Corp.
S. Kille S. Kille
ISODE Consortium ISODE Consortium
Expires in six months from 30 August 1996 Intended Category: Standards Track October 22, 1996
Intended Category: Standards Track
Lightweight Directory Access Protocol: Lightweight Directory Access Protocol:
Standard and Pilot Attribute Definitions Standard and Pilot Attribute Definitions
<draft-ietf-asid-ldapv3-attributes-02.txt> <draft-ietf-asid-ldapv3-attributes-03.txt>
1. Status of this Memo 1. Status of this Memo
This document is an Internet-Draft. Internet-Drafts are working This document is an Internet-Draft. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas, and documents of the Internet Engineering Task Force (IETF), its areas, and
its working groups. Note that other groups may also distribute working its working groups. Note that other groups may also distribute working
documents as Internet-Drafts. documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
skipping to change at line 78 skipping to change at page 2, line 31
[ "NAME" <DirectoryStrings> ] -- name used in AttributeType [ "NAME" <DirectoryStrings> ] -- name used in AttributeType
[ "DESC" <DirectoryString> ] [ "DESC" <DirectoryString> ]
[ "OBSOLETE" ] [ "OBSOLETE" ]
[ "SUP" <oid> ] -- derived from this other AttributeType [ "SUP" <oid> ] -- derived from this other AttributeType
[ "EQUALITY" <oid> ] -- Matching Rule name [ "EQUALITY" <oid> ] -- Matching Rule name
[ "ORDERING" <oid> ] -- Matching Rule name [ "ORDERING" <oid> ] -- Matching Rule name
[ "SUBSTR" <oid> ] -- Matching Rule name [ "SUBSTR" <oid> ] -- Matching Rule name
[ "SYNTAX" <DirectoryString> ] -- see section 4.2 [ "SYNTAX" <DirectoryString> ] -- see section 4.2
[ "SINGLE-VALUE" ] -- default multi-valued [ "SINGLE-VALUE" ] -- default multi-valued
[ "COLLECTIVE" ] -- default not collective [ "COLLECTIVE" ] -- default not collective
[ "DYNAMIC" ] -- default not dynamic
[ "NO-USER-MODIFICATION" ] -- default user modifiable [ "NO-USER-MODIFICATION" ] -- default user modifiable
[ "USAGE" <AttributeUsage> ] -- default user applications [ "USAGE" <AttributeUsage> ] -- default user applications
")" ")"
<AttributeUsage> ::= <AttributeUsage> ::=
"userApplications" "userApplications"
| "directoryOperation" | "directoryOperation"
| "distributedOperation" -- DSA-shared | "distributedOperation" -- DSA-shared
| "dSAOperation" -- DSA-specific, value depends on server | "dSAOperation" -- DSA-specific, value depends on server
Some of these samples contain a brief definition of the attribute in Servers are not required to provide the same or any text
the DESC field; servers are not required to provide the same or any text
in the description part of the subschema values they maintain. in the description part of the subschema values they maintain.
Servers should implement all the attribute types in section 5.1, and Servers must implement all the attribute types in section 5.1, and
may also implement the types listed in sections 6.1 and 7.1. may also implement the types listed in sections 6.1 and 7.1. Servers must
be able to perform equality matching of values, but need not perform
any additional validity checks on attribute values.
Servers may support additional names and attributes not listed in this Servers may recognize additional names and attributes not listed in this
document. Later documents may define additional types. document. Later documents may define additional types.
Servers may implement additional attribute types not listed in this Servers may implement additional attribute types not listed in this
document, and if they do so, should publish the definitions of the types document, and if they do so, must publish the definitions of the types
in the attributeTypes attribute of their subschema subentries. in the attributeTypes attribute of their subschema subentries.
AttributeDescriptions may be used as the value in a NAME part of an
AttributeTypeDescription. Note that these are case insensitive.
4.2. Syntaxes 4.2. Syntaxes
This section defines general requirements for LDAP attribute value This section defines general requirements for LDAP attribute value
syntax encodings. All documents defining attribute syntax encodings for syntax encodings. All documents defining attribute syntax encodings for
use with LDAP are expected to conform to these requirements. use with LDAP are expected to conform to these requirements.
The encoding rules defined for a given attribute syntax must produce The encoding rules defined for a given attribute syntax must produce
octet strings. To the greatest extent possible, encoded octet octet strings. To the greatest extent possible, encoded octet
strings should be usable in their native encoded form for display strings should be usable in their native encoded form for display
purposes. In particular, encoding rules for attribute syntaxes purposes. In particular, encoding rules for attribute syntaxes
skipping to change at line 182 skipping to change at page 4, line 30
<oids> ::= <oid> | '(' <oidlist> ')' <oids> ::= <oid> | '(' <oidlist> ')'
<oidlist> ::= <oidlist> '$' <oid> | <oid> <oidlist> ::= <oidlist> '$' <oid> | <oid>
-- <oid> is defined in 5.2.1.15 -- <oid> is defined in 5.2.1.15
4.2.2 Binary Transfer of Values 4.2.2 Binary Transfer of Values
This encoding format is used if the binary encoding is requested by the This encoding format is used if the binary encoding is requested by the
client for an attribute. The value, an instance of the ASN.1 client for an attribute, or if the attribute syntax name is 'Binary'. The
AttributeValue type, is DER-encoded, and this sequence of octets is used value, an instance of the ASN.1 AttributeValue type, is BER-encoded,
as the value. subject to the restrictions of section 5.1 of [1], and this sequence of
octets is used as the value.
DER, a subset of BER, is defined in [13].
All servers must be capable of supporting this form for both generating All servers must implement this form for both generating Search responses
Search results and parsing Add, Compare and Modify requests. Clients and parsing Add, Compare and Modify requests. Clients must be prepared
should be prepared for receiving values in binary (e.g. userCertificate), receiving values in binary (e.g. userCertificate or audio), and must not
and should not display them directly to users. simply display binary or unrecognized values to users.
4.2.3. Syntax Names 4.2.3. Syntax Namees
Names of syntaxes for use with LDAPv3 are ASCII strings which either Names of syntaxes for use with LDAP are ASCII strings which either
begin with a letter and contain only letters or digits. begin with a letter and contain only letters or digits. The names are
The names are case insensitive. Historically since syntaxes correspond to case insensitive. Historically since syntaxes correspond to ASN.1 types,
ASN.1 types, they have been named starting with a capital letter. they have been named starting with a capital letter. A suggested upper
bound on the number of characters in value with a DirectoryString or
IA5String syntax or the number of bytes in a value for all other syntaxes
may be indicated by appending this bound count inside of curly braces, e.g.
"DirectoryString{64}". Note that a single character of the DirectoryString
may be encoded in more than one byte since UTF-8 is a variable-length
encoding.
Syntax names do not have global scope: two clients or servers may Syntax names do not have global scope: two clients or servers may
know of different syntaxes with the same name. know of different syntaxes with the same name.
The definition of additional arbitrary syntaxes is strongly depreciated The definition of additional arbitrary syntaxes is strongly depreciated
since it will hinder interoperability: today's client and server since it will hinder interoperability: today's client and server
implementations generally do not have the ability to dynamically recognize implementations generally do not have the ability to dynamically recognize
new syntaxes. In most cases attributes should be defined with the new syntaxes. In most cases attributes will be defined with the
DirectoryString syntax. DirectoryString syntax.
The following syntax names are used for attributes in this document. The following syntax names are used for attributes in this document.
Servers should recognize all the syntax names in this section, but are Servers are only required to implement the syntaxes in section 5.2.
only required to implement the syntaxes in section 5.2. Later documents
may define additional syntaxes.
AccessPoint ACIItem AccessPoint ACIItem
AttributeTypeDescription Audio AttributeTypeDescription Audio
Binary BitString Binary BitString
Certificate CertificateList Certificate CertificateList
CertificatePair DataQualitySyntax CertificatePair DataQualitySyntax
DeliveryMethod DirectoryString DeliveryMethod DirectoryString
DITContentRuleDescription DN DITContentRuleDescription DN
DSAQualitySyntax DSEType DSAQualitySyntax DSEType
EnhancedGuide FacsimileTelephoneNumber EnhancedGuide FacsimileTelephoneNumber
skipping to change at line 242 skipping to change at page 5, line 42
PostalAddress PresentationAddress PostalAddress PresentationAddress
PrintableString ProtocolInformation PrintableString ProtocolInformation
SubtreeSpecification SupplierAndConsumers SubtreeSpecification SupplierAndConsumers
SupplierInformation SupplierOrConsumer SupplierInformation SupplierOrConsumer
TelephoneNumber TeletexTerminalIdentifier TelephoneNumber TeletexTerminalIdentifier
TelexNumber UTCTime TelexNumber UTCTime
4.3. Object Classes 4.3. Object Classes
These are described as sample values for the subschema "objectClasses" These are described as sample values for the subschema "objectClasses"
attribute for a server which implements the LDAPv3 schema. attribute for a server which implements the LDAP schema.
While lines have been folded for readability, the values transferred in While lines have been folded for readability, the values transferred in
protocol would not contain newlines. protocol would not contain newlines.
Object class descriptions are written according to the following BNF: Object class descriptions are written according to the following BNF:
<ObjectClassDescription> ::= "(" <ObjectClassDescription> ::= "("
<oid> -- ObjectClass identifier <oid> -- ObjectClass identifier
[ "NAME" <DirectoryStrings> ] [ "NAME" <DirectoryStrings> ]
[ "DESC" <DirectoryString> ] [ "DESC" <DirectoryString> ]
[ "OBSOLETE" ] [ "OBSOLETE" ]
[ "SUP" <oids> ] -- Superior ObjectClasses [ "SUP" <oids> ] -- Superior ObjectClasses
[ ( "ABSTRACT" | "STRUCTURAL" | "AUXILIARY" ) ] -- default structural [ ( "ABSTRACT" | "STRUCTURAL" | "AUXILIARY" ) ] -- default structural
[ "MUST" <oids> ] -- AttributeTypes [ "MUST" <oids> ] -- AttributeTypes
[ "MAY" <oids> ] -- AttributeTypes [ "MAY" <oids> ] -- AttributeTypes
")" ")"
Servers must implement all the object classes in section 5.3:
Servers should implement all the object classes in section 5.3:
account alias account alias
applicationEntity applicationProcess applicationEntity applicationProcess
certificationAuthority country certificationAuthority country
dNSDomain dSA dNSDomain dSA
device document device document
documentSeries domain documentSeries domain
domainRelatedObject friendlyCountry domainRelatedObject friendlyCountry
groupOfNames groupOfUniqueNames groupOfNames groupOfUniqueNames
locality newPilotPerson locality newPilotPerson
organization organizationalPerson organization organizationalPerson
skipping to change at line 281 skipping to change at page 6, line 26
person pilotDSA person pilotDSA
pilotObject pilotOrganization pilotObject pilotOrganization
qualityLabelledData rFC822localPart qualityLabelledData rFC822localPart
residentialPerson room residentialPerson room
simpleSecurityObject strongAuthenticationUser simpleSecurityObject strongAuthenticationUser
top top
and may also implement the object classes of 6.3 and 7.3. and may also implement the object classes of 6.3 and 7.3.
Servers may implement additional object classes not listed in this Servers may implement additional object classes not listed in this
document, and if they do so, should publish the definitions of the classes document, and if they do so, must publish the definitions of the classes
in the objectClasses attribute of their subschema subentries. Later in the objectClasses attribute of their subschema subentries. Later
documents may define additional object classes. documents may define additional object classes.
4.4. Matching Rules 4.4. Matching Rules
Matching rules are used by servers to compare attribute values against Matching rules are used by servers to compare attribute values against
assertion values when performing search and comparision operations. assertion values when performing Search and Compare operations.
Most of the attributes given in this document will have an equality Most of the attributes given in this document will have an equality
matching rule defined. matching rule defined.
Matching rule descriptions are written according to the following BNF: Matching rule descriptions are written according to the following BNF:
<MatchingRuleDescription> ::= "(" <MatchingRuleDescription> ::= "("
<oid> -- MatchingRule identifier <oid> -- MatchingRule identifier
[ "NAME" <DirectoryStrings> ] [ "NAME" <DirectoryStrings> ]
[ "DESC" <DirectoryString> ] [ "DESC" <DirectoryString> ]
[ "OBSOLETE" ] [ "OBSOLETE" ]
"SYNTAX" <DirectoryString> "SYNTAX" <DirectoryString>
")" ")"
Servers should implement all the matching rules in section 5.4: Servers must implement all the matching rules in section 5.4:
bitStringMatch caseExactIA5Match bitStringMatch caseExactIA5Match
caseIgnoreIA5Match caseIgnoreListMatch caseIgnoreIA5Match caseIgnoreListMatch
caseIgnoreMatch distinguishedNameMatch caseIgnoreMatch distinguishedNameMatch
generalizedTimeMatch integerMatch generalizedTimeMatch integerMatch
numericStringMatch objectIdentifierMatch numericStringMatch objectIdentifierMatch
octetStringMatch telephoneNumberMatch octetStringMatch telephoneNumberMatch
and may also implement the matching rules of 6.4 and 7.4. and may also implement the matching rules of 6.4 and 7.4.
Servers may implement additional matching rules not listed in this Servers may implement additional matching rules not listed in this
document, and if they do so, should publish the definitions of the document, and if they do so, must publish the definitions of the
matching rules in the matchingRules attribute of their matching rules in the matchingRules attribute of their
subschema subentries. subschema subentries.
5. Core Definitions 5. Mandatory Definitions
Section 5 contains definitions which should be implemented by all servers Section 5 contains definitions which must be implemented by all servers.
and clients.
5.1. Attribute Types 5.1. Attribute Types
Servers must recognize all the attributes of this section. Servers must recognize all the attributes of this section (5.1.1 - 5.1.5).
5.1.1. Standard User Attributes 5.1.1. Standard User Attributes
The attributes listed in this section are those defined in X.520(1993), The attributes listed in this section are those defined in X.520(1993),
likely to be present in user entries. Servers must recognize all the likely to be present in user entries. Servers must recognize all the
attributes of this section. The semantics of attributes 2.5.4.0 through attributes of this section. The semantics of attributes 2.5.4.0 through
2.5.4.40 are summarized in RFC 1274. 2.5.4.40 are summarized in RFC 1274.
( 2.5.4.0 NAME 'objectClass' EQUALITY objectIdentifierMatch SYNTAX 'OID' ) ( 2.5.4.0 NAME 'objectClass' EQUALITY objectIdentifierMatch SYNTAX 'OID' )
( 2.5.4.1 NAME 'aliasedObjectName' EQUALITY distinguishedNameMatch ( 2.5.4.1 NAME 'aliasedObjectName' EQUALITY distinguishedNameMatch
SYNTAX 'DN' SINGLE-VALUE ) SYNTAX 'DN' SINGLE-VALUE )
( 2.5.4.2 NAME 'knowledgeInformation' EQUALITY caseIgnoreMatch ( 2.5.4.2 NAME 'knowledgeInformation' EQUALITY caseIgnoreMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString{32768}' )
( 2.5.4.3 NAME 'cn' SUP name ) ( 2.5.4.3 NAME 'cn' SUP name )
( 2.5.4.4 NAME 'sn' SUP name ) ( 2.5.4.4 NAME 'sn' SUP name )
( 2.5.4.5 NAME 'serialNumber' EQUALITY caseIgnoreMatch ( 2.5.4.5 NAME 'serialNumber' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'PrintableString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'PrintableString{64}' )
( 2.5.4.6 NAME 'c' SUP name SINGLE-VALUE ) ( 2.5.4.6 NAME 'c' SUP name SINGLE-VALUE )
( 2.5.4.7 NAME 'l' SUP name ) ( 2.5.4.7 NAME 'l' SUP name )
( 2.5.4.8 NAME 'st' SUP name ) ( 2.5.4.8 NAME 'st' SUP name )
( 2.5.4.9 NAME 'street' EQUALITY caseIgnoreMatch ( 2.5.4.9 NAME 'street' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{128}' )
( 2.5.4.10 NAME 'o' SUP name ) ( 2.5.4.10 NAME 'o' SUP name )
( 2.5.4.11 NAME 'ou' SUP name ) ( 2.5.4.11 NAME 'ou' SUP name )
( 2.5.4.12 NAME 'title' SUP name ) ( 2.5.4.12 NAME 'title' SUP name )
( 2.5.4.13 NAME 'description' EQUALITY caseIgnoreMatch ( 2.5.4.13 NAME 'description' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{1024}' )
( 2.5.4.14 NAME 'searchGuide' SYNTAX 'Guide' ) ( 2.5.4.14 NAME 'searchGuide' SYNTAX 'Guide' )
( 2.5.4.15 NAME 'businessCategory' EQUALITY caseIgnoreMatch ( 2.5.4.15 NAME 'businessCategory' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{128}' )
( 2.5.4.16 NAME 'postalAddress' EQUALITY caseIgnoreListMatch ( 2.5.4.16 NAME 'postalAddress' EQUALITY caseIgnoreListMatch
SUBSTRINGS caseIgnoreListSubstringsMatch SYNTAX 'PostalAddress' ) SUBSTRINGS caseIgnoreListSubstringsMatch SYNTAX 'PostalAddress' )
( 2.5.4.17 NAME 'postalCode' EQUALITY caseIgnoreMatch ( 2.5.4.17 NAME 'postalCode' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{40}' )
( 2.5.4.18 NAME 'postOfficeBox' EQUALITY caseIgnoreMatch ( 2.5.4.18 NAME 'postOfficeBox' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{40}' )
( 2.5.4.19 NAME 'physicalDeliveryOfficeName' EQUALITY caseIgnoreMatch ( 2.5.4.19 NAME 'physicalDeliveryOfficeName' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{128}' )
( 2.5.4.20 NAME 'telephoneNumber' EQUALITY telephoneNumberMatch ( 2.5.4.20 NAME 'telephoneNumber' EQUALITY telephoneNumberMatch
SUBSTRINGS telephoneNumberSubstringsMatch SYNTAX 'TelephoneNumber' ) SUBSTRINGS telephoneNumberSubstringsMatch SYNTAX 'TelephoneNumber{32}' )
( 2.5.4.21 NAME 'telexNumber' SYNTAX 'TelexNumber' ) ( 2.5.4.21 NAME 'telexNumber' SYNTAX 'TelexNumber' )
( 2.5.4.22 NAME 'teletexTerminalIdentifier' ( 2.5.4.22 NAME 'teletexTerminalIdentifier'
SYNTAX 'TeletexTerminalIdentifier' ) SYNTAX 'TeletexTerminalIdentifier' )
( 2.5.4.23 NAME 'facsimileTelephoneNumber' ( 2.5.4.23 NAME 'facsimileTelephoneNumber'
SYNTAX 'FacsimileTelephoneNumber' ) SYNTAX 'FacsimileTelephoneNumber' )
( 2.5.4.24 NAME 'x121Address' EQUALITY numericStringMatch ( 2.5.4.24 NAME 'x121Address' EQUALITY numericStringMatch
SUBSTRINGS numericStringSubstringsMatch SYNTAX 'NumericString' ) SUBSTRINGS numericStringSubstringsMatch SYNTAX 'NumericString{15}' )
( 2.5.4.25 NAME 'internationaliSDNNumber' EQUALITY numericStringMatch ( 2.5.4.25 NAME 'internationaliSDNNumber' EQUALITY numericStringMatch
SUBSTRINGS numericStringSubstringsMatch SYNTAX 'NumericString' ) SUBSTRINGS numericStringSubstringsMatch SYNTAX 'NumericString{16}' )
( 2.5.4.26 NAME 'registeredAddress' SUP postalAddress ( 2.5.4.26 NAME 'registeredAddress' SUP postalAddress
SYNTAX 'PostalAddress' ) SYNTAX 'PostalAddress' )
( 2.5.4.27 NAME 'destinationIndicator' EQUALITY caseIgnoreMatch ( 2.5.4.27 NAME 'destinationIndicator' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'PrintableString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'PrintableString{128}' )
( 2.5.4.28 NAME 'preferredDeliveryMethod' SYNTAX 'DeliveryMethod' ( 2.5.4.28 NAME 'preferredDeliveryMethod' SYNTAX 'DeliveryMethod'
SINGLE-VALUE ) SINGLE-VALUE )
( 2.5.4.29 NAME 'presentationAddress' EQUALITY presentationAddressMatch ( 2.5.4.29 NAME 'presentationAddress' EQUALITY presentationAddressMatch
SYNTAX 'PresentationAddress' SINGLE-VALUE ) SYNTAX 'PresentationAddress' SINGLE-VALUE )
( 2.5.4.30 NAME 'supportedApplicationContext' ( 2.5.4.30 NAME 'supportedApplicationContext'
EQUALITY objectIdentifierMatch SYNTAX 'OID' ) EQUALITY objectIdentifierMatch SYNTAX 'OID' )
skipping to change at line 417 skipping to change at page 9, line 4
( 2.5.4.29 NAME 'presentationAddress' EQUALITY presentationAddressMatch ( 2.5.4.29 NAME 'presentationAddress' EQUALITY presentationAddressMatch
SYNTAX 'PresentationAddress' SINGLE-VALUE ) SYNTAX 'PresentationAddress' SINGLE-VALUE )
( 2.5.4.30 NAME 'supportedApplicationContext' ( 2.5.4.30 NAME 'supportedApplicationContext'
EQUALITY objectIdentifierMatch SYNTAX 'OID' ) EQUALITY objectIdentifierMatch SYNTAX 'OID' )
( 2.5.4.31 NAME 'member' SUP distinguishedName ) ( 2.5.4.31 NAME 'member' SUP distinguishedName )
( 2.5.4.32 NAME 'owner' SUP distinguishedName ) ( 2.5.4.32 NAME 'owner' SUP distinguishedName )
( 2.5.4.33 NAME 'roleOccupant' SUP distinguishedName ) ( 2.5.4.33 NAME 'roleOccupant' SUP distinguishedName )
( 2.5.4.34 NAME 'seeAlso' SUP distinguishedName ) ( 2.5.4.34 NAME 'seeAlso' SUP distinguishedName )
( 2.5.4.35 NAME 'userPassword' EQUALITY octetStringMatch ( 2.5.4.35 NAME 'userPassword' EQUALITY octetStringMatch
SYNTAX 'Password' ) SYNTAX 'Password{128}' )
( 2.5.4.36 NAME 'userCertificate' SYNTAX 'Certificate' ) ( 2.5.4.36 NAME 'userCertificate' SYNTAX 'Certificate' )
( 2.5.4.37 NAME 'cACertificate' SYNTAX 'Certificate' ) ( 2.5.4.37 NAME 'cACertificate' SYNTAX 'Certificate' )
( 2.5.4.38 NAME 'authorityRevocationList' SYNTAX 'CertificateList' ) ( 2.5.4.38 NAME 'authorityRevocationList' SYNTAX 'CertificateList' )
( 2.5.4.39 NAME 'certificateRevocationList' SYNTAX 'CertificateList' ) ( 2.5.4.39 NAME 'certificateRevocationList' SYNTAX 'CertificateList' )
( 2.5.4.40 NAME 'crossCertificatePair' SYNTAX 'CertificatePair' ) ( 2.5.4.40 NAME 'crossCertificatePair' SYNTAX 'CertificatePair' )
( 2.5.4.41 NAME 'name' ( 2.5.4.41 NAME 'name'
DESC 'The name attribute type is the attribute supertype from which DESC 'The name attribute type is the attribute supertype from which
string attribute types typically used for naming may be formed.' string attribute types typically used for naming may be formed.'
EQUALITY caseIgnoreMatch EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{32768}' )
( 2.5.4.42 NAME 'givenName' SUP name ) ( 2.5.4.42 NAME 'givenName' SUP name )
( 2.5.4.43 NAME 'initials' ( 2.5.4.43 NAME 'initials'
DESC 'The initials attribute type contains the initials of some or all DESC 'The initials attribute type contains the initials of some or all
of an individuals names, but not the surname(s).' of an individuals names, but not the surname(s).'
SUP name ) SUP name )
( 2.5.4.44 NAME 'generationQualifier' ( 2.5.4.44 NAME 'generationQualifier'
DESC 'e.g. Jr or II.' DESC 'e.g. Jr or II.'
skipping to change at line 482 skipping to change at page 10, line 17
( 2.5.4.49 NAME 'distinguishedName' ( 2.5.4.49 NAME 'distinguishedName'
DESC 'This is not the name of the object itself, but a base type DESC 'This is not the name of the object itself, but a base type
from which attributes with DN syntax inherit.' from which attributes with DN syntax inherit.'
EQUALITY distinguishedNameMatch EQUALITY distinguishedNameMatch
SYNTAX 'DN' ) SYNTAX 'DN' )
( 2.5.4.50 NAME 'uniqueMember' EQUALITY uniqueMemberMatch ( 2.5.4.50 NAME 'uniqueMember' EQUALITY uniqueMemberMatch
SYNTAX 'NameAndOptionalUID' ) SYNTAX 'NameAndOptionalUID' )
( 2.5.4.51 NAME 'houseIdentifier' EQUALITY caseIgnoreMatch ( 2.5.4.51 NAME 'houseIdentifier' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{32768}' )
5.1.2. Pilot User Attributes 5.1.2. Pilot User Attributes
These attributes are defined in RFC 1274. Servers must recognize all the These attributes are defined in RFC 1274. Servers must recognize all the
attributes of this section. attributes of this section.
( 0.9.2342.19200300.100.1.1 NAME 'uid' EQUALITY caseIgnoreMatch ( 0.9.2342.19200300.100.1.1 NAME 'uid' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORaddress' ( 0.9.2342.19200300.100.1.2 NAME 'textEncodedORaddress'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.3 NAME 'mail' EQUALITY caseIgnoreIA5Match ( 0.9.2342.19200300.100.1.3 NAME 'mail' EQUALITY caseIgnoreIA5Match
SUBSTRINGS caseIgnoreIA5SubstringsMatch SYNTAX 'IA5String' ) SUBSTRINGS caseIgnoreIA5SubstringsMatch SYNTAX 'IA5String{256}' )
( 0.9.2342.19200300.100.1.4 NAME 'info' EQUALITY caseIgnoreMatch ( 0.9.2342.19200300.100.1.4 NAME 'info' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{2048}' )
( 0.9.2342.19200300.100.1.5 NAME 'drink' EQUALITY caseIgnoreMatch ( 0.9.2342.19200300.100.1.5 NAME 'drink' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' EQUALITY caseIgnoreMatch ( 0.9.2342.19200300.100.1.6 NAME 'roomNumber' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.7 NAME 'photo' SYNTAX 'Fax' )
( 0.9.2342.19200300.100.1.7 NAME 'photo' SYNTAX 'Fax{250000}' )
( 0.9.2342.19200300.100.1.8 NAME 'userClass' EQUALITY caseIgnoreMatch ( 0.9.2342.19200300.100.1.8 NAME 'userClass' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.9 NAME 'host' EQUALITY caseIgnoreMatch ( 0.9.2342.19200300.100.1.9 NAME 'host' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.10 NAME 'manager' ( 0.9.2342.19200300.100.1.10 NAME 'manager'
EQUALITY distinguishedNameMatch SYNTAX 'DN' ) EQUALITY distinguishedNameMatch SYNTAX 'DN' )
( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier' ( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' EQUALITY caseIgnoreMatch ( 0.9.2342.19200300.100.1.12 NAME 'documentTitle' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.13 NAME 'documentVersion' ( 0.9.2342.19200300.100.1.13 NAME 'documentVersion'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor' ( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor'
EQUALITY distinguishedNameMatch SYNTAX 'DN' ) EQUALITY distinguishedNameMatch SYNTAX 'DN' )
( 0.9.2342.19200300.100.1.15 NAME 'documentLocation' ( 0.9.2342.19200300.100.1.15 NAME 'documentLocation'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.20 NAME 'homePhone' EQUALITY telephoneNumberMatch ( 0.9.2342.19200300.100.1.20 NAME 'homePhone' EQUALITY telephoneNumberMatch
SUBSTRINGS telephoneNumberSubstringsMatch SYNTAX 'TelephoneNumber' ) SUBSTRINGS telephoneNumberSubstringsMatch SYNTAX 'TelephoneNumber{32}' )
( 0.9.2342.19200300.100.1.21 NAME 'secretary' ( 0.9.2342.19200300.100.1.21 NAME 'secretary'
EQUALITY distinguishedNameMatch SYNTAX 'DN' ) EQUALITY distinguishedNameMatch SYNTAX 'DN' )
( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 'OtherMailbox' ) ( 0.9.2342.19200300.100.1.22 NAME 'otherMailbox' SYNTAX 'OtherMailbox' )
( 0.9.2342.19200300.100.1.25 NAME 'dc' EQUALITY caseIgnoreIA5Match ( 0.9.2342.19200300.100.1.25 NAME 'dc' EQUALITY caseIgnoreIA5Match
SUBSTRINGS caseIgnoreIA5SubstringsMatch SYNTAX 'IA5String' ) SUBSTRINGS caseIgnoreIA5SubstringsMatch SYNTAX 'IA5String' )
( 0.9.2342.19200300.100.1.26 NAME 'dNSRecord' ( 0.9.2342.19200300.100.1.26 NAME 'dNSRecord'
skipping to change at line 564 skipping to change at page 11, line 46
( 0.9.2342.19200300.100.1.38 NAME 'associatedName' ( 0.9.2342.19200300.100.1.38 NAME 'associatedName'
EQUALITY distinguishedNameMatch SYNTAX 'DN' ) EQUALITY distinguishedNameMatch SYNTAX 'DN' )
( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress' ( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress'
EQUALITY caseIgnoreListMatch EQUALITY caseIgnoreListMatch
SUBSTRINGS caseIgnoreListSubstringsMatch SYNTAX 'PostalAddress' ) SUBSTRINGS caseIgnoreListSubstringsMatch SYNTAX 'PostalAddress' )
( 0.9.2342.19200300.100.1.40 NAME 'personalTitle' ( 0.9.2342.19200300.100.1.40 NAME 'personalTitle'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString' )
( 0.9.2342.19200300.100.1.41 NAME 'mobile' EQUALITY telephoneNumberMatch ( 0.9.2342.19200300.100.1.41 NAME 'mobile' EQUALITY telephoneNumberMatch
SUBSTRINGS telephoneNumberSubstringsMatch SYNTAX 'TelephoneNumber' ) SUBSTRINGS telephoneNumberSubstringsMatch SYNTAX 'TelephoneNumber{32}' )
( 0.9.2342.19200300.100.1.42 NAME 'pager' EQUALITY telephoneNumberMatch ( 0.9.2342.19200300.100.1.42 NAME 'pager' EQUALITY telephoneNumberMatch
SUBSTRINGS telephoneNumberSubstringsMatch SYNTAX 'TelephoneNumber' ) SUBSTRINGS telephoneNumberSubstringsMatch SYNTAX 'TelephoneNumber{32}' )
( 0.9.2342.19200300.100.1.43 NAME 'co' EQUALITY caseIgnoreMatch ( 0.9.2342.19200300.100.1.43 NAME 'co' EQUALITY caseIgnoreMatch
SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' ) SUBSTRINGS caseIgnoreSubstringsMatch SYNTAX 'DirectoryString' )
( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier'
( 0.9.2342.19200300.100.1.44 NAME 'pilotUniqueIdentifier'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString' )
( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus' ( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox' ( 0.9.2342.19200300.100.1.46 NAME 'janetMailbox'
EQUALITY caseIgnoreIA5Match SUBSTRINGS caseIgnoreIA5SubstringsMatch EQUALITY caseIgnoreIA5Match SUBSTRINGS caseIgnoreIA5SubstringsMatch
SYNTAX 'IA5String' ) SYNTAX 'IA5String{256}' )
( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption' ( 0.9.2342.19200300.100.1.47 NAME 'mailPreferenceOption'
SYNTAX 'INTEGER' SINGLE-VALUE NO-USER-MODIFICATION SYNTAX 'INTEGER' SINGLE-VALUE }
USAGE directoryOperation )
( 0.9.2342.19200300.100.1.48 NAME 'buildingName' ( 0.9.2342.19200300.100.1.48 NAME 'buildingName'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString{256}' )
( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality' ( 0.9.2342.19200300.100.1.49 NAME 'dSAQuality'
SYNTAX 'DSAQualitySyntax' SINGLE-VALUE ) SYNTAX 'DSAQualitySyntax' SINGLE-VALUE )
( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality' ( 0.9.2342.19200300.100.1.50 NAME 'singleLevelQuality'
SYNTAX 'DataQualitySyntax' SINGLE-VALUE ) SYNTAX 'DataQualitySyntax' SINGLE-VALUE )
( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQuality' ( 0.9.2342.19200300.100.1.51 NAME 'subtreeMinimumQuality'
SYNTAX 'DataQualitySyntax' SINGLE-VALUE ) SYNTAX 'DataQualitySyntax' SINGLE-VALUE )
( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQuality' ( 0.9.2342.19200300.100.1.52 NAME 'subtreeMaximumQuality'
SYNTAX 'DataQualitySyntax' SINGLE-VALUE ) SYNTAX 'DataQualitySyntax' SINGLE-VALUE )
( 0.9.2342.19200300.100.1.53 NAME 'personalSignature' ( 0.9.2342.19200300.100.1.53 NAME 'personalSignature'
SYNTAX 'Fax' ) SYNTAX 'Fax{50000}' )
( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect' ( 0.9.2342.19200300.100.1.54 NAME 'dITRedirect'
EQUALITY distinguishedNameMatch SYNTAX 'DN' ) EQUALITY distinguishedNameMatch SYNTAX 'DN' )
( 0.9.2342.19200300.100.1.55 NAME 'audio' SYNTAX 'Audio' ) ( 0.9.2342.19200300.100.1.55 NAME 'audio' SYNTAX 'Audio{250000}' )
( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher' ( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher'
EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch EQUALITY caseIgnoreMatch SUBSTRINGS caseIgnoreSubstringsMatch
SYNTAX 'DirectoryString' ) SYNTAX 'DirectoryString' )
( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' SYNTAX 'JPEG' ) ( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' SYNTAX 'JPEG' )
5.1.3. Standard Operational Attributes 5.1.3. Standard Operational Attributes
All servers must recognize the the attribute types defined in this All servers must recognize the attribute types defined in this
section. section.
( 2.5.18.1 NAME 'createTimestamp' EQUALITY generalizedTimeMatch ( 2.5.18.1 NAME 'createTimestamp' EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch SYNTAX 'GeneralizedTime' ORDERING generalizedTimeOrderingMatch SYNTAX 'GeneralizedTime'
SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
( 2.5.18.2 NAME 'modifyTimestamp' EQUALITY generalizedTimeMatch ( 2.5.18.2 NAME 'modifyTimestamp' EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch SYNTAX 'GeneralizedTime' ORDERING generalizedTimeOrderingMatch SYNTAX 'GeneralizedTime'
SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
skipping to change at line 653 skipping to change at page 13, line 39
SINGLE-VALUE USAGE directoryOperation ) SINGLE-VALUE USAGE directoryOperation )
( 2.5.21.5 NAME 'attributeTypes' ( 2.5.21.5 NAME 'attributeTypes'
EQUALITY objectIdentifierFirstComponentMatch EQUALITY objectIdentifierFirstComponentMatch
SYNTAX 'AttributeTypeDescription' USAGE directoryOperation ) SYNTAX 'AttributeTypeDescription' USAGE directoryOperation )
( 2.5.21.6 NAME 'objectClasses' ( 2.5.21.6 NAME 'objectClasses'
EQUALITY objectIdentifierFirstComponentMatch EQUALITY objectIdentifierFirstComponentMatch
SYNTAX 'ObjectClassDescription' USAGE directoryOperation ) SYNTAX 'ObjectClassDescription' USAGE directoryOperation )
5.1.3. LDAP Operational Attributes 5.1.4. LDAP Operational Attributes
All servers must recognize and implement the attribute types defined in All servers must recognize the attribute types defined in this section.
this section. (Of course, it is not required that the server provide (Of course, it is not required that the server provide values for these
values for these attributes, when the attribute corresponds to a feature attributes, when the attribute corresponds to a feature which the server
which the server does not implement.) does not implement.)
( 1.3.6.1.4.1.1466.101.120.1 NAME 'administratorsAddress' ( 1.3.6.1.4.1.1466.101.120.1 NAME 'administratorsAddress'
DESC 'This attribute\27s values are string containing the addresses of DESC 'This attribute\27s values are string containing the addresses of
the LDAP server\27s human administrator. This information may the LDAP server\27s human administrator. This information may
be of use when tracking down problems in an Internet distributed be of use when tracking down problems in an Internet distributed
directory. For simplicity the syntax of the values are limited to directory. For simplicity the syntax of the values are limited to
being URLs of the mailto form with an RFC 822 address: being URLs of the mailto form with an RFC 822 address:
"mailto:user@domain". Future versions of this protocol may permit "mailto:user@domain". Future versions of this protocol may permit
other forms of addresses.' other forms of addresses.'
SYNTAX 'IA5String' USAGE dSAOperation ) SYNTAX 'IA5String' USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.2 NAME 'currentTime' ( 1.3.6.1.4.1.1466.101.120.2 NAME 'currentTime'
DESC 'This attribute has a single value, a string containing a DESC 'This attribute has a single value, a string containing a
GeneralizedTime character string. This attribute need only GeneralizedTime character string. This attribute need only
be present if the server supports LDAP strong or protected be present if the server supports LDAP strong or protected
simple authentication. Otherwise if the server does not know simple authentication. Otherwise if the server does not know
the current time, or does not choose to present it to clients, the current time, or does not choose to present it to clients,
this attribute need not be present. The client may wish to this attribute need not be present. The client may wish to
use this value to detect whether a strong or protected bind use this value to detect whether a strong or protected bind
is failing because the client and server clocks are not is failing because the client and server clocks are not
sufficiently synchronized. Clients should not use this time sufficiently synchronized. Clients must not use this time
field for setting their own system clock.' field for setting their own system clock.'
SYNTAX 'GeneralizedTime' SINGLE-VALUE USAGE dSAOperation ) SYNTAX 'GeneralizedTime' SINGLE-VALUE USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.3 NAME 'serverName' ( 1.3.6.1.4.1.1466.101.120.3 NAME 'serverName'
DESC 'This attribute\27s value is the server\27s Distinguished Name. DESC 'This attribute\27s value is the server\27s Distinguished Name.
If the server does not have a Distinguished Name it will not If the server does not have a Distinguished Name it will not
be able to accept X.509-style strong authentication, and this be able to accept X.509-style strong authentication, and this
attribute should be absent. However the presence of this attribute must be absent. However the presence of this
attribute does not guarantee that the server will be able to attribute does not guarantee that the server will be able to
perform strong authentication. If the server acts as a perform strong authentication. If the server acts as a
gateway to more than one X.500 DSA capable of strong gateway to more than one X.500 DSA capable of strong
authentication, there may be multiple values of this authentication, there may be multiple values of this
attribute, one per DSA. (Note: this attribute is distinct attribute, one per DSA. (Note: this attribute is distinct
from myAccessPoint, for it is not required that a server from myAccessPoint, for it is not required that a server
have a presentation address in order to perform strong have a presentation address in order to perform strong
authentication.) (Note: it is likely that clients will authentication.) (Note: it is likely that clients will
retrieve this attribute in binary.)' retrieve this attribute in binary.)'
SYNTAX 'DN' USAGE dSAOperation ) SYNTAX 'DN' USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.4 NAME 'certificationPath' ( 1.3.6.1.4.1.1466.101.120.4 NAME 'certificationPath'
DESC 'This attribute contains a binary DER encoding of an DESC 'This attribute contains a binary DER encoding of an
AF.CertificatePath data type, which is the certificate AF.CertificatePath data type, which is the certificate
path for a server. If the server does not have a certificate path for a server. If the server does not have a certificate
path this attribute should be absent. (Note: this attribute path this attribute must be absent. (Note: this attribute
may only be retrieved in binary.)' may only be retrieved in binary.)'
SYNTAX 'CertificatePath' USAGE dSAOperation ) SYNTAX 'CertificatePath' USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' ( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts'
DESC 'The values of this attribute correspond to naming contexts DESC 'The values of this attribute correspond to naming contexts
which this server masters or shadows. If the server does which this server masters or shadows. If the server does
not master any information (e.g. it is an LDAP gateway to a not master any information (e.g. it is an LDAP gateway to a
public X.500 directory) this attribute should be absent. If public X.500 directory) this attribute must be absent. If
the server believes it contains the entire directory, the the server believes it contains the entire directory, the
attribute should have a single value, and that value should attribute must have a single value, and that value must
be the empty string (indicating the null DN of the root). be the empty string (indicating the null DN of the root).
This attribute will allow clients to choose suitable base This attribute will allow clients to choose suitable base
objects for searching when it has contacted a server.' objects for searching when it has contacted a server.'
SYNTAX 'DN' USAGE dSAOperation ) SYNTAX 'DN' USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' ( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer'
DESC 'The values of this attribute are URLs of other servers which DESC 'The values of this attribute are URLs of other servers which
may be contacted when this server becomes unavailable. If may be contacted when this server becomes unavailable. If
the server does not know of any other servers which could be the server does not know of any other servers which could be
used this attribute should be absent. Clients should cache this used this attribute must be absent. Clients may cache this
information in case their preferred LDAP server later becomes information in case their preferred LDAP server later becomes
unavailable.' unavailable.'
SYNTAX 'IA5String' USAGE dSAOperation ) SYNTAX 'IA5String' USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' ( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension'
DESC 'The values of this attribute are OBJECT IDENTIFIERs, DESC 'The values of this attribute are OBJECT IDENTIFIERs,
the names of supported extensions the names of supported extended operations
which the server supports. If the server does not support which the server supports. If the server does not support
any extensions this attribute should be absent.' any extensions this attribute must be absent.'
SYNTAX 'OID' USAGE dSAOperation ) SYNTAX 'OID' USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl'
DESC 'The values of this attribute are the names of supported session
controls which the server supports. If the server does not
support any controls this attribute must be absent.'
SYNTAX 'LDAPString' USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms'
DESC 'The values of this attribute are the names of supported SASL
mechanisms which the server supports. If the server does not
support any mechanisms this attribute must be absent.'
SYNTAX 'LDAPString' USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.8 NAME 'entryName' ( 1.3.6.1.4.1.1466.101.120.8 NAME 'entryName'
SYNTAX 'DN' SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation ) SYNTAX 'DN' SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
( 1.3.6.1.4.1.1466.101.120.9 NAME 'modifyRights' ( 1.3.6.1.4.1.1466.101.120.9 NAME 'modifyRights'
SYNTAX 'ModifyRight' NO-USER-MODIFICATION USAGE dSAOperation ) SYNTAX 'ModifyRight' NO-USER-MODIFICATION USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.10 NAME 'incompleteEntry' ( 1.3.6.1.4.1.1466.101.120.10 NAME 'incompleteEntry'
SYNTAX 'BOOLEAN' NO-USER-MODIFICATION USAGE dSAOperation ) SYNTAX 'BOOLEAN' NO-USER-MODIFICATION USAGE dSAOperation )
( 1.3.6.1.4.1.1466.101.120.11 NAME 'fromEntry' ( 1.3.6.1.4.1.1466.101.120.11 NAME 'fromEntry'
SYNTAX 'BOOLEAN' NO-USER-MODIFICATION USAGE dSAOperation ) SYNTAX 'BOOLEAN' NO-USER-MODIFICATION USAGE dSAOperation )
5.1.4 LDAP User Attributes 5.1.5. LDAP User Attributes
The following attributes may be of use in naming entries, or as The following attributes may be of use in naming entries, or as
descriptive attributes in entries. descriptive attributes in entries.
( 1.3.6.1.4.1.1466.101.121.1 NAME 'url' ( 1.3.6.1.4.1.1466.101.121.1 NAME 'url'
DESC 'Uniform Resource Locator' DESC 'Uniform Resource Locator'
EQUALITY caseExactIA5Match SYNTAX 'IA5String' ) EQUALITY caseExactIA5Match SYNTAX 'IA5String' )
Note that the associatedDomain attribute may be used to hold a DNS name. Note that the associatedDomain attribute may be used to hold a DNS name.
skipping to change at line 781 skipping to change at page 16, line 30
5.2.1.2. PrintableString 5.2.1.2. PrintableString
The encoding of a value with PrintableString syntax is the string The encoding of a value with PrintableString syntax is the string
value itself. PrintableString is limited to the characters in value itself. PrintableString is limited to the characters in
production <p> of section 4.1. production <p> of section 4.1.
5.2.1.3. DirectoryString 5.2.1.3. DirectoryString
A string with DirectoryString syntax is encoded in the UTF-8 form of A string with DirectoryString syntax is encoded in the UTF-8 form of
Unicode. ISO 10646 (a superset of Unicode). Servers and clients must be prepared to
receive arbitrary Unicode characters in values.
For characters in the PrintableString form, the value is encoded as the For characters in the PrintableString form, the value is encoded as the
string value itself. string value itself.
If it is of the TeletexString form, then the characters are transliterated If it is of the TeletexString form, then the characters are transliterated
to their equivalents in UniversalString, and encoded in UTF-8 [11]. to their equivalents in UniversalString, and encoded in UTF-8 [11].
If it is of the UniversalString or BMPString forms [12], UTF-8 is used to If it is of the UniversalString or BMPString forms [12], UTF-8 is used to
encode them. encode them.
Note: the form of DirectoryString is not indicated in protocol. Servers Note: the form of DirectoryString is not indicated in protocol unless the
which convert to DAP should choose an appropriate form. attribute value is carried in binary. Servers which convert to DAP must
choose an appropriate form. Servers must not reject values merely because
they contain legal Unicode characters outside of the range of printable
ASCII.
5.2.1.4. Certificate 5.2.1.4. Certificate
Because of the changes from X.509(1988) and X.509(1993) and additional Because of the changes from X.509(1988) and X.509(1993) and additional
changes to the ASN.1 definition to support certificate extensions, no changes to the ASN.1 definition to support certificate extensions, no
string representation is defined, and values with Certificate syntax string representation is defined, and values with Certificate syntax
should only be transferred using the binary encoding, by requesting or must only be transferred using the binary encoding, by requesting or
returning the attributes with descriptions "userCertificate;binary" or returning the attributes with descriptions "userCertificate;binary" or
"caCertificate;binary". The BNF notation in RFC 1778 for "caCertificate;binary". The BNF notation in RFC 1778 for
"User Certificate" is not recommended to be used. "User Certificate" is not recommended to be used.
5.2.1.5. CertificateList 5.2.1.5. CertificateList
Because of the incompatibility of the X.509(1988) and X.509(1993) Because of the incompatibility of the X.509(1988) and X.509(1993)
definitions of revocation lists, values with CertificateList syntax definitions of revocation lists, values with CertificateList syntax
must only be transferred using a binary encoding, by requesting or must only be transferred using a binary encoding, by requesting or
returning the attributes with descriptions returning the attributes with descriptions
skipping to change at line 856 skipping to change at page 18, line 4
'g3fax' | 'g4fax' | 'ia5' | 'videotex' | 'telephone' 'g3fax' | 'g4fax' | 'ia5' | 'videotex' | 'telephone'
5.2.1.10. EnhancedGuide 5.2.1.10. EnhancedGuide
Values with the EnhancedGuide syntax are encoded according to the Values with the EnhancedGuide syntax are encoded according to the
following BNF: following BNF:
<EnhancedGuide> ::= <objectclass> '#' <criteria> '#' <subset> <EnhancedGuide> ::= <objectclass> '#' <criteria> '#' <subset>
<subset> ::= "baseobject" | "oneLevel" | "wholeSubtree" <subset> ::= "baseobject" | "oneLevel" | "wholeSubtree"
The <criteria> production is defined in the Guide syntax below. The <criteria> production is defined in the Guide syntax below.
This syntax has been added subsequent to RFC 1778.
This syntax has been added subseqent to RFC 1779.
5.2.1.11. FacsimileTelephoneNumber 5.2.1.11. FacsimileTelephoneNumber
Values with the FacsimileTelephoneNumber syntax are encoded according Values with the FacsimileTelephoneNumber syntax are encoded according
to the following BNF: to the following BNF:
<fax-number> ::= <printablestring> [ '$' <faxparameters> ] <fax-number> ::= <printablestring> [ '$' <faxparameters> ]
<faxparameters> ::= <faxparm> | <faxparm> '$' <faxparameters> <faxparameters> ::= <faxparm> | <faxparm> '$' <faxparameters>
skipping to change at line 905 skipping to change at page 18, line 52
The encoding of a value with the NameAndOptionalUID syntax is according The encoding of a value with the NameAndOptionalUID syntax is according
to the following BNF: to the following BNF:
<NameAndOptionalUID> ::= <NameAndOptionalUID> ::=
<DistinguishedName> [ '#' <BitString> ] <DistinguishedName> [ '#' <BitString> ]
Although the '#' character may occur in a string representation of a Although the '#' character may occur in a string representation of a
distinguished name, no additional special quoting is done in the distinguished name, no additional special quoting is done in the
distinguished name other than that of [5]. distinguished name other than that of [5].
This syntax has been added subseqent to RFC 1779. This syntax has been added subsequent to RFC 1778.
5.2.1.14. NumericString 5.2.1.14. NumericString
The encoding of a string with the NumericString syntax is the string The encoding of a string with the NumericString syntax is the string
value itself. value itself.
5.2.1.15. OID 5.2.1.15. OID
Values with OID (Object Identifier) syntax are encoded according to the Values with OID (Object Identifier) syntax are encoded according to the
following BNF: following BNF:
<oid> ::= <descr> | <numericoid> <oid> ::= <descr> | <numericoid>
<descr> ::= <keystring> <descr> ::= <keystring>
<numericoid> ::= <numericstring> | <numericstring> '.' <numericoid> <numericoid> ::= <numericstring> | <numericstring> '.' <numericoid>
In the above BNF, <descr> is the syntactic representation of an In the above BNF, <descr> is the syntactic representation of an
object descriptor, which must consist of letters and digits, starting object descriptor, which must consist of letters and digits, starting
with a letter. When encoding values with OID syntax, the first encoding with a letter. When encoding values with OID syntax, the first encoding
option should be used in preference to the second. That is, in encoding option must be used in preference to the second. That is, in encoding
object identifiers, object descriptors (where assigned and known by object identifiers, object descriptors (where assigned and known by
the implementation) should be used in preference to numeric oids to the implementation) must be used in preference to numeric oids to
the greatest extent possible. All permitted object descriptors for use the greatest extent possible. All permitted object descriptors for use
in LDAP are given in Appendix A, B and C. No other object descriptors in LDAP are given in this document. No other object descriptors may be
should be used. (Note that clients can expect that LDAPv2 implementations used. (Note that clients must expect that LDAPv2 implementations
may return object descriptors other than those listed.) will return object descriptors other than those listed.)
5.2.1.16. Password 5.2.1.16. Password
Values with Password syntax are encoded as octet strings. Values with Password syntax are encoded as octet strings.
5.2.1.17. PostalAddress 5.2.1.17. PostalAddress
Values with the PostalAddress syntax are encoded according to the Values with the PostalAddress syntax are encoded according to the
following BNF: following BNF:
skipping to change at line 993 skipping to change at page 20, line 37
Values with the TelexNumber syntax are encoded according to the Values with the TelexNumber syntax are encoded according to the
following BNF: following BNF:
<telex-number> ::= <actual-number> '$' <country> '$' <answerback> <telex-number> ::= <actual-number> '$' <country> '$' <answerback>
<actual-number> ::= <printablestring> <actual-number> ::= <printablestring>
<country> ::= <printablestring> <country> ::= <printablestring>
<answerback> ::= <printablestring> <answerback> ::= <printablestring>
In the above, <actual-number> is the syntactic representation of the In the above, <actual-number> is the syntactic representation of the
number portion of the TELEX number being encoded, <country> is the number portion of the TELEX number being encoded, <country> is the
TELEX country code, and <answerback> is the answerback code of a TELEX country code, and <answerback> is the answerback code of a
TELEX terminal. TELEX terminal.
5.2.1.23. UTCTime 5.2.1.23. UTCTime
Values with UTCTime syntax are encoded as if they were printable Values with UTCTime syntax are encoded as if they were printable
strings with the strings containing a UTCTime value. strings with the strings containing a UTCTime value. This is historical;
new attribute definitions must use GeneralizedTime instead.
5.2.1.24. Boolean 5.2.1.24. Boolean
Values with Boolean syntax are encoded according to the following Values with Boolean syntax are encoded according to the following
BNF: BNF:
<boolean> ::= "TRUE" | "FALSE" <boolean> ::= "TRUE" | "FALSE"
Boolean values have an encoding of "TRUE" if they are logically true, Boolean values have an encoding of "TRUE" if they are logically true,
and have an encoding of "FALSE" otherwise. and have an encoding of "FALSE" otherwise.
skipping to change at line 1105 skipping to change at page 22, line 47
Values with this syntax are encoded according to the BNF given at the Values with this syntax are encoded according to the BNF given at the
start of section 4.1. For example, start of section 4.1. For example,
( 2.5.4.0 NAME 'objectClass' SYNTAX 'OID' ) ( 2.5.4.0 NAME 'objectClass' SYNTAX 'OID' )
5.2.3.2. GeneralizedTime 5.2.3.2. GeneralizedTime
Values of this syntax are encoded as printable strings, represented Values of this syntax are encoded as printable strings, represented
as specified in X.208. Note that the time zone must be specified. as specified in X.208. Note that the time zone must be specified.
For example, It is strongly recommended that Zulu time zone be used. For example,
199412161032Z 199412161032Z
5.2.3.3. INTEGER 5.2.3.3. INTEGER
Values with INTEGER syntax are encoded as the decimal representation Values with INTEGER syntax are encoded as the decimal representation
of their values, with each decimal digit represented by the its of their values, with each decimal digit represented by the its
character equivalent. So the number 1321 is represented by the character character equivalent. So the number 1321 is represented by the character
string "1321". string "1321".
skipping to change at line 1214 skipping to change at page 24, line 55
MUST ( uniqueMember $ cn ) MUST ( uniqueMember $ cn )
MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )
5.3.2. Pilot Classes 5.3.2. Pilot Classes
These object classes are defined in RFC 1274. All servers must recognize These object classes are defined in RFC 1274. All servers must recognize
these object class names. these object class names.
( 0.9.2342.19200300.100.4.3 NAME 'pilotObject' SUP top STRUCTURAL ( 0.9.2342.19200300.100.4.3 NAME 'pilotObject' SUP top STRUCTURAL
MAY ( jpegPhoto $ audio $ dITRedirect $ lastModifiedBy $ MAY ( jpegPhoto $ audio $ dITRedirect $ lastModifiedBy $
lastModifiedTime $ pilotUniqueIdentifier $ manager $ photo $ info ) ) lastModifiedTime $ uniqueIdentifier $ manager $ photo $ info ) )
( 0.9.2342.19200300.100.4.4 NAME 'newPilotPerson' SUP person ( 0.9.2342.19200300.100.4.4 NAME 'newPilotPerson' SUP person
STRUCTURAL MAY ( personalSignature $ mailPreferenceOption $ STRUCTURAL MAY ( personalSignature $ mailPreferenceOption $
organizationalStatus $ pagerTelephoneNumber $ mobileTelephoneNumber $ organizationalStatus $ pagerTelephoneNumber $ mobileTelephoneNumber $
otherMailbox $ janetMailbox $ businessCategory $ otherMailbox $ janetMailbox $ businessCategory $
preferredDeliveryMethod $ personalTitle $ secretary $ preferredDeliveryMethod $ personalTitle $ secretary $
homePostalAddress $ homePhone $ userClass $ roomNumber $ homePostalAddress $ homePhone $ userClass $ roomNumber $
favouriteDrink $ rfc822Mailbox $ textEncodedORaddress $ userid ) ) favouriteDrink $ rfc822Mailbox $ textEncodedORaddress $ userid ) )
( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL ( 0.9.2342.19200300.100.4.5 NAME 'account' SUP top STRUCTURAL
MUST userid MAY ( host $ ou $ o $ l $ seeAlso $ description ) ) MUST userid MAY ( host $ ou $ o $ l $ seeAlso $ description ) )
skipping to change at line 1309 skipping to change at page 26, line 44
( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' SYNTAX 'IA5String' ) ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' SYNTAX 'IA5String' )
( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' SYNTAX 'IA5String' ) ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' SYNTAX 'IA5String' )
When performing the caseIgnoreMatch, caseIgnoreListMatch, When performing the caseIgnoreMatch, caseIgnoreListMatch,
telephoneNumberMatch, caseExactIA5Match and caseIgnoreIA5Match, telephoneNumberMatch, caseExactIA5Match and caseIgnoreIA5Match,
multiple adjoining whitespace characters are treated the same as multiple adjoining whitespace characters are treated the same as
an individual space, and leading and trailing whitespace is ignored. an individual space, and leading and trailing whitespace is ignored.
6. X.500 Definitions 6. X.500 Definitions
Servers which support the X.500(1993) protocols are required to recognize Servers which implement the X.500(1993) protocols are required to recognize
these attributes types, syntaxes, object classes and matching rules. All these attributes types, syntaxes, object classes and matching rules, where
other servers are not required to implement any definitions in section 6, they correspond to X.500 features implemented by that server. No other
although they may do so. servers are required to implement any definitions in section 6, although
they may do so.
Non-management clients should not assume they are recognized by servers. Clients must not assume these definitions are recognized by all servers.
6.1. Attribute Types 6.1. Attribute Types
6.1.1. User Attributes 6.1.1. User Attributes
All user attributes of X.500 are listed in section 5.1.1. All user attributes of X.500 are listed in section 5.1.1.
6.1.2. Collective Attributes 6.1.2. Collective Attributes
These attributes are stored in collective attribute subentries, but may These attributes are stored in collective attribute subentries, but may
skipping to change at line 1457 skipping to change at page 29, line 37
( 2.5.12.7 NAME 'secondaryShadows' ( 2.5.12.7 NAME 'secondaryShadows'
EQUALITY supplierAndConsumersMatch EQUALITY supplierAndConsumersMatch
SYNTAX 'SupplierAndConsumers' SYNTAX 'SupplierAndConsumers'
NO-USER-MODIFICATION USAGE dSAOperation ) NO-USER-MODIFICATION USAGE dSAOperation )
6.1.4. LDAP-defined Operational Attributes 6.1.4. LDAP-defined Operational Attributes
6.1.4.1. targetSystem 6.1.4.1. targetSystem
( 1.3.6.1.4.1.1466.101.120.10 NAME 'targetSystem' ( 1.3.6.1.4.1.1466.101.120.12 NAME 'targetSystem'
SYNTAX 'AccessPoint' SINGLE-VALUE NO-USER-MODIFICATION SYNTAX 'AccessPoint' SINGLE-VALUE NO-USER-MODIFICATION
USAGE distributedOperation ) USAGE distributedOperation )
The value of this attribute may be supplied in an AddEntry operation The value of this attribute may be supplied in an AddEntry operation
to inform the Directory of the target server on which the entry is to to inform the Directory of the target server on which the entry is to
be held. This is used to create a new naming context in the directory be held. This is used to create a new naming context in the directory
tree. A server which does not permit the use of this attribute should tree. A server which does not permit the use of this attribute must
return an appropriate error code if it is present in the attribute list. return an appropriate error code if it is present in the attribute list.
This attribute will generally not be present in the entry after the add This attribute will generally not be present in the entry after the add
is completed. is completed.
6.2. Syntaxes 6.2. Syntaxes
6.2.1. Standard Syntaxes 6.2.1. Standard Syntaxes
6.2.1.1. ACIItem 6.2.1.1. ACIItem
This syntax appears too complicated for a compact string representation This syntax appears too complicated for a compact string representation
to be useful. Clients should only request and servers should only return to be useful. Clients must only request and servers must only return
values which use the the binary DER encoding of the value, e.g. values which use the the binary encoding of the value, e.g.
"entryACI;binary". "entryACI;binary".
It is recommended that clients that wish to only determine whether they It is recommended that clients that wish to only determine whether they
have been granted permission to modify an entry use the "modifyRights" have been granted permission to modify an entry use the "modifyRights"
attribute rather than attempt to parse this syntax. attribute rather than attempt to parse this syntax.
6.2.1.2. AccessPoint 6.2.1.2. AccessPoint
Values with AccessPoint syntax are encoded according to the Values with AccessPoint syntax are encoded according to the
following BNF: following BNF:
skipping to change at line 1534 skipping to change at page 31, line 21
[ "NAME" <DirectoryStrings> ] [ "NAME" <DirectoryStrings> ]
[ "DESC" <DirectoryString> ] [ "DESC" <DirectoryString> ]
[ "OBSOLETE" ] [ "OBSOLETE" ]
"FORM" <oid> -- NameForm "FORM" <oid> -- NameForm
[ "SUP" <RuleIdentifiers> ] -- superior DITStructureRules [ "SUP" <RuleIdentifiers> ] -- superior DITStructureRules
")" ")"
<RuleIdentifier> ::= <integer> <RuleIdentifier> ::= <integer>
<RuleIdentifiers> ::= <RuleIdentifiers> ::=
<RuleIdentifier> <RuleIdentifier> |
|
"(" <RuleIdentifierList> ")" "(" <RuleIdentifierList> ")"
<RuleIdentifierList> ::= <RuleIdentifierList> ::=
<RuleIdentifierList> <RuleIdentifier> <RuleIdentifierList> <RuleIdentifier>
| |
-- empty list -- empty list
6.2.1.5. DSEType 6.2.1.5. DSEType
Values with DSEType syntax are encoded according to the following BNF: Values with DSEType syntax are encoded according to the following BNF:
<DSEType> ::= '(' <DSEBitList> ')' <DSEType> ::= '(' <DSEBitList> ')'
skipping to change at line 1725 skipping to change at page 35, line 4
-- <strvalue> is the string encoding of the value -- <strvalue> is the string encoding of the value
<perm-list> ::= <perm> | <perm> <dollar> <perm-list> <perm-list> ::= <perm> | <perm> <dollar> <perm-list>
-- one or more of the bits in permission, if set -- one or more of the bits in permission, if set
<perm> ::= 'add' | 'remove' | 'rename' | 'move' <perm> ::= 'add' | 'remove' | 'rename' | 'move'
<octo> ::= [ <whsp> ] '#' [ <whsp> ] <octo> ::= [ <whsp> ] '#' [ <whsp> ]
<dollar> ::= [ <whsp> ] '$' [ <whsp> ] <dollar> ::= [ <whsp> ] '$' [ <whsp> ]
For example, For example,
# entry # entry
add $ remove # attribute $ cn add $ remove # attribute $ cn
add $ remove # attribute $ sn add $ remove # attribute $ sn
remove # value $ memberName $ CN=Babs, O=Michigan, C=US remove # value $ memberName $ CN=Babs, O=Michigan, C=US
6.3. Object Classes 6.3. Object Classes
The following object classes should be recognized. The following object classes may be recognized.
( 2.5.17.0 NAME 'subentry' SUP top STRUCTURAL ( 2.5.17.0 NAME 'subentry' SUP top STRUCTURAL
MUST ( cn $ subtreeSpecification ) ) MUST ( cn $ subtreeSpecification ) )
( 2.5.17.1 NAME 'accessControlSubentry' AUXILIARY ) ( 2.5.17.1 NAME 'accessControlSubentry' AUXILIARY )
( 2.5.17.2 NAME 'collectiveAttributeSubentry' AUXILIARY ) ( 2.5.17.2 NAME 'collectiveAttributeSubentry' AUXILIARY )
( 2.5.20.1 NAME 'subschema' AUXILIARY ( 2.5.20.1 NAME 'subschema' AUXILIARY
MAY ( dITStructureRules $ nameForms $ ditContentRules $ MAY ( dITStructureRules $ nameForms $ ditContentRules $
skipping to change at line 1792 skipping to change at page 36, line 17
masterAndShadowAccessPointsMatch 2.5.14.1 masterAndShadowAccessPointsMatch 2.5.14.1
supplierOrConsumerInformationMatch 2.5.14.2 supplierOrConsumerInformationMatch 2.5.14.2
supplierAndConsumersMatch 2.5.14.3 supplierAndConsumersMatch 2.5.14.3
6.5. Other 6.5. Other
The string 'excludeAllCollectiveAttributes' is defined as a synonym The string 'excludeAllCollectiveAttributes' is defined as a synonym
for the OID 2.5.18.0. It would typically be used as a value of the for the OID 2.5.18.0. It would typically be used as a value of the
collectiveExclusions attribute. collectiveExclusions attribute.
7. Optional Definitions 7. Other Optional Definitions
7.1. Attribute Types 7.1. Attribute Types
7.1.1. Obsolete Attributes 7.1.1. Obsolete Attributes
Implementors should use modifyTimestamp and modifiersName instead. Implementors must use modifyTimestamp and modifiersName instead.
( 0.9.2342.19200300.100.1.23 NAME 'lastModifiedTime' OBSOLETE ( 0.9.2342.19200300.100.1.23 NAME 'lastModifiedTime' OBSOLETE
SYNTAX 'UTCTime' ) SYNTAX 'UTCTime' )
( 0.9.2342.19200300.100.1.24 NAME 'lastModifiedBy' OBSOLETE ( 0.9.2342.19200300.100.1.24 NAME 'lastModifiedBy' OBSOLETE
EQUALITY distinguishedNameMatch SYNTAX 'DN' ) EQUALITY distinguishedNameMatch SYNTAX 'DN' )
7.2. Syntaxes 7.2. Syntaxes
7.2.1 MHSORAddress 7.2.1 MHSORAddress
skipping to change at line 1852 skipping to change at page 37, line 25
where <oraddress> is as defined in RFC 1327. where <oraddress> is as defined in RFC 1327.
7.3. Object Classes 7.3. Object Classes
7.3.1. Obsolete Classes 7.3.1. Obsolete Classes
( 0.9.2342.19200300.100.4.22 NAME 'oldQualityLabelledData' SUP top ( 0.9.2342.19200300.100.4.22 NAME 'oldQualityLabelledData' SUP top
STRUCTURAL MUST dSAQuality STRUCTURAL MUST dSAQuality
MAY ( subtreeMaximumQuality $ subtreeMinimumQuality ) ) MAY ( subtreeMaximumQuality $ subtreeMinimumQuality ) )
The oldQualityLabelledData object class is historical and should not be The oldQualityLabelledData object class is historical and must not be
used for defining new objects. used for defining new objects.
7.3.2. extensibleObject 7.3.2. extensibleObject
( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' ( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject'
SUP top AUXILIARY ) SUP top AUXILIARY )
This class, if present in an entry, permits that entry to optionally This class, if present in an entry, permits that entry to optionally
hold any attribute. The MAY attribute list of this class is implicitly hold any attribute. The MAY attribute list of this class is implicitly
the set of all attributes known to the server. The mandatory attributes the set of all attributes known to the server. The mandatory attributes
of the other object classes of this entry are still required to be of the other object classes of this entry are still required to be
present. present.
Note that not all servers will implement this object class, and those Note that not all servers will implement this object class, and those
which do not will reject requests to add entries which contain this which do not will reject requests to add entries which contain this
object class, or modify an entry to add this object class. object class, or modify an entry to add this object class.
skipping to change at line 1934 skipping to change at page 39, line 8
Richmond Richmond
TW9 1DT TW9 1DT
UK UK
Phone: +44-181-332-9091 Phone: +44-181-332-9091
EMail: S.Kille@isode.com EMail: S.Kille@isode.com
11. Bibliography 11. Bibliography
[1] M. Wahl, T. Howes, S. Kille, "Lightweight Directory Access Protocol [1] M. Wahl, T. Howes, S. Kille, "Lightweight Directory Access Protocol
(Version 3)", INTERNET DRAFT <draft-ietf-asid-ldapv3-protocol-02.txt>, (Version 3)", INTERNET-DRAFT <draft-ietf-asid-ldapv3-protocol-03.txt>,
August 1996. October 1996.
[2] The Directory: Selected Attribute Types. ITU-T Recommendation [2] The Directory: Selected Attribute Types. ITU-T Recommendation
X.520, 1993. X.520, 1993.
[3] The Directory: Models. ITU-T Recommendation X.501, 1993. [3] The Directory: Models. ITU-T Recommendation X.501, 1993.
[4] P. Barker, S. Kille, "The COSINE and Internet X.500 Schema", RFC [4] P. Barker, S. Kille, "The COSINE and Internet X.500 Schema", RFC
1274, November 1991. 1274, November 1991.
[5] M. Wahl, S. Kille, "A UTF-8 String Representation of Distinguished [5] M. Wahl, S. Kille, "A UTF-8 String Representation of Distinguished
Names", INTERNET DRAFT <draft-ietf-asid-ldapv3-dn-00.txt>, August 1996. Names", INTERNET-DRAFT <draft-ietf-asid-ldapv3-dn-00.txt>, August 1996.
[6] S. Kille, "A String Representation for Presentation Addresses", [6] S. Kille, "A String Representation for Presentation Addresses",
RFC 1278, University College London, November 1991. RFC 1278, University College London, November 1991.
[7] Terminal Equipment and Protocols for Telematic Services - [7] Terminal Equipment and Protocols for Telematic Services -
Standardization of Group 3 facsimile apparatus for document Standardization of Group 3 facsimile apparatus for document
transmission. CCITT, Recommendation T.4. transmission. CCITT, Recommendation T.4.
[8] JPEG File Interchange Format (Version 1.02). Eric Hamilton, [8] JPEG File Interchange Format (Version 1.02). Eric Hamilton,
C-Cube Microsystems, Milpitas, CA, September 1, 1992. C-Cube Microsystems, Milpitas, CA, September 1, 1992.
skipping to change at line 1976 skipping to change at page 39, line 50
[12] Universal Multiple-Octet Coded Character Set (UCS) - Architecture [12] Universal Multiple-Octet Coded Character Set (UCS) - Architecture
and Basic Multilingual Plane, ISO/IEC 10646-1 : 1993. and Basic Multilingual Plane, ISO/IEC 10646-1 : 1993.
[13] The Directory: Authentication Framework. ITU-T Recommendation [13] The Directory: Authentication Framework. ITU-T Recommendation
X.509 (1993). X.509 (1993).
[14] Abstract Syntax Notation One (ASN.1) - Specification of Basic [14] Abstract Syntax Notation One (ASN.1) - Specification of Basic
Notation. ITU-T Recommendation X.680, 1994. Notation. ITU-T Recommendation X.680, 1994.
<draft-ietf-asid-ldapv3-attributes-02.txt> <draft-ietf-asid-ldapv3-attributes-03.txt>
Expires: March 2, 1997
 End of changes. 109 change blocks. 
134 lines changed or deleted 153 lines changed or added

This html diff was produced by rfcdiff 1.33. The latest version is available from http://tools.ietf.org/tools/rfcdiff/