3698
PROPOSED STANDARD
Lightweight Directory Access Protocol (LDAP): Additional Matching Rules
Authors: K. Zeilenga
Date: February 2004
Working Group: NON WORKING GROUP
Stream: IETF
Abstract
This document provides a collection of matching rules for use with the Lightweight Directory Access Protocol (LDAP). As these matching rules are simple adaptations of matching rules specified for use with the X.500 Directory, most are already in wide use. [STANDARDS-TRACK]
RFC 3698
PROPOSED STANDARD
Updated by: 4517
Network Working Group K. Zeilenga, Ed.
Request for Comments: 3698 OpenLDAP Foundation
Updates: <a href="./rfc2798">2798</a> February 2004
Category: Standards Track
<span class="h1">Lightweight Directory Access Protocol (LDAP):</span>
<span class="h1">Additional Matching Rules</span>
Status of this Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2004). All Rights Reserved.
Abstract
This document provides a collection of matching rules for use with
the Lightweight Directory Access Protocol (LDAP). As these matching
rules are simple adaptations of matching rules specified for use with
the X.500 Directory, most are already in wide use.
Table of Contents
<a href="#section-1">1</a>. Background and Intended Use. . . . . . . . . . . . . . . . . . <a href="#page-2">2</a>
<a href="#section-2">2</a>. Matching Rules . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-2">2</a>
<a href="#section-2.1">2.1</a>. booleanMatch . . . . . . . . . . . . . . . . . . . . . . <a href="#page-2">2</a>
<a href="#section-2.2">2.2</a>. caseExactMatch . . . . . . . . . . . . . . . . . . . . . <a href="#page-2">2</a>
<a href="#section-2.3">2.3</a>. caseExactOrderingMatch . . . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-2.4">2.4</a>. caseExactSubstringsMatch . . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-2.5">2.5</a>. caseIgnoreListSubstringsMatch. . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-2.6">2.6</a>. directoryStringFirstComponentMatch . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.7">2.7</a>. integerOrderingMatch . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.8">2.8</a>. keywordMatch . . . . . . . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-2.9">2.9</a>. numericStringOrderingMatch . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-2.10">2.10</a>. octetStringOrderingMatch . . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-2.11">2.11</a>. storedPrefixMatch. . . . . . . . . . . . . . . . . . . . <a href="#page-5">5</a>
<a href="#section-2.12">2.12</a>. wordMatch. . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-3">3</a>. Security Considerations. . . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-4">4</a>. IANA Considerations. . . . . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-5">5</a>. Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-6">6</a>. References . . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<span class="grey">Zeilenga Standards Track [Page 1]</span><span id="page-2" ></span>
<span class="grey"><a href="./rfc3698">RFC 3698</a> LDAP: Additional Matching Rules February 2004</span>
<a href="#section-6.1">6.1</a>. Normative References . . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-6.2">6.2</a>. Informative References . . . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-7">7</a>. Author's Address . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-8">8</a>. Full Copyright Statement . . . . . . . . . . . . . . . . . . . <a href="#page-9">9</a>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Background and Intended Use</span>
This document adapts additional X.500 Directory [<a href="#ref-X.500" title=""The Directory -- Overview of concepts, models and services,"">X.500</a>] matching
rules [<a href="#ref-X.520" title=""The Directory: Selected Attribute Types"">X.520</a>] for use with the Lightweight Directory Access Protocol
(LDAP) [<a href="./rfc3377" title=""Lightweight Directory Access Protocol (v3): Technical Specification"">RFC3377</a>]. Most of these rules are widely used today on the
Internet, such as in support of the inetOrgPerson [<a href="./rfc2798" title=""The LDAP inetOrgPerson Object Class"">RFC2798</a>] and
Policy Core Information Model [<a href="./rfc3703" title=""Policy Core LDAP Schema"">RFC3703</a>] LDAP schemas. The rules are
applicable to many other applications.
This document supersedes the informational matching rules
descriptions provided in <a href="./rfc2798">RFC 2798</a> that are now provided in this
document. Specifically, <a href="#section-2">section 2</a> of this document replaces <a href="./rfc2798#section-9.3.3">section</a>
<a href="./rfc2798#section-9.3.3">9.3.3 of RFC 2798</a>.
Schema definitions are provided using LDAP description formats
[<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>]. Definitions provided here are formatted (line wrapped)
for readability.
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Matching Rules</span>
<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>. booleanMatch</span>
The booleanMatch rule compares for equality a asserted Boolean value
with an attribute value of BOOLEAN syntax. The rule returns TRUE if
and only if the values are the same, i.e., both are TRUE or both are
FALSE. (Source: X.520)
( 2.5.13.13 NAME 'booleanMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
The BOOLEAN (1.3.6.1.4.1.1466.115.121.1.7) syntax is described in
[<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a>. caseExactMatch</span>
The caseExactMatch rule compares for equality the asserted value with
an attribute value of DirectoryString syntax. The rule is identical
to the caseIgnoreMatch [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>] rule except that case is not
ignored. (Source: X.520)
<span class="grey">Zeilenga Standards Track [Page 2]</span><span id="page-3" ></span>
<span class="grey"><a href="./rfc3698">RFC 3698</a> LDAP: Additional Matching Rules February 2004</span>
( 2.5.13.5 NAME 'caseExactMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax is
described in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.3" href="#section-2.3">2.3</a>. caseExactOrderingMatch</span>
The caseExactOrderingMatch rule compares the collation order of the
asserted string with an attribute value of DirectoryString syntax.
The rule is identical to the caseIgnoreOrderingMatch [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>] rule
except that letters are not folded. (Source: X.520)
( 2.5.13.6 NAME 'caseExactOrderingMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax is
described in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.4" href="#section-2.4">2.4</a>. caseExactSubstringsMatch</span>
The caseExactSubstringsMatch rule determines whether the asserted
value(s) are substrings of an attribute value of DirectoryString
syntax. The rule is identical to the caseIgnoreSubstringsMatch
[<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>] rule except that case is not ignored. (Source: X.520)
( 2.5.13.7 NAME 'caseExactSubstringsMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )
The SubstringsAssertion (1.3.6.1.4.1.1466.115.121.1.58) syntax is
described in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.5" href="#section-2.5">2.5</a>. caseIgnoreListSubstringsMatch</span>
The caseIgnoreListSubstringMatch rule compares the asserted substring
with an attribute value which is a sequence of DirectoryStrings, but
where the case (upper or lower) is not significant for comparison
purposes. The asserted value matches a stored value if and only if
the asserted value matches the string formed by concatenating the
strings of the stored value. This matching is done according to the
caseIgnoreSubstringsMatch [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>] rule; however, none of the
initial, any, or final values of the asserted value are considered to
match a substring of the concatenated string which spans more than
one of the strings of the stored value. (Source: X.520)
( 2.5.13.12 NAME 'caseIgnoreListSubstringsMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )
<span class="grey">Zeilenga Standards Track [Page 3]</span><span id="page-4" ></span>
<span class="grey"><a href="./rfc3698">RFC 3698</a> LDAP: Additional Matching Rules February 2004</span>
The SubstringsAssertion (1.3.6.1.4.1.1466.115.121.1.58) syntax is
described in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.6" href="#section-2.6">2.6</a>. directoryStringFirstComponentMatch</span>
The directoryStringFirstComponentMatch rule compares for equality the
asserted DirectoryString value with an attribute value of type
SEQUENCE whose first component is mandatory and of type
DirectoryString. The rule returns TRUE if and only if the attribute
value has a first component whose value matches the asserted
DirectoryString using the rules of caseIgnoreMatch [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>]. A
value of the assertion syntax is derived from a value of the
attribute syntax by using the value of the first component of the
SEQUENCE. (Source: X.520)
( 2.5.13.31 NAME 'directoryStringFirstComponentMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax is
described in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.7" href="#section-2.7">2.7</a>. integerOrderingMatch</span>
The integerOrderingMatch rule compares the ordering of the asserted
integer with an attribute value of INTEGER syntax. The rule returns
True if the attribute value is less than the asserted value. (Source:
X.520)
( 2.5.13.15 NAME 'integerOrderingMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
The INTEGER (1.3.6.1.4.1.1466.115.121.1.27) syntax is described in
[<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.8" href="#section-2.8">2.8</a>. keywordMatch</span>
The keywordMatch rule compares the asserted string with keywords in
an attribute value of DirectoryString syntax. The rule returns TRUE
if and only if the asserted value matches any keyword in the
attribute value. The identification of keywords in an attribute
value and of the exactness of match are both implementation specific.
(Source: X.520)
( 2.5.13.33 NAME 'keywordMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax is
described in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="grey">Zeilenga Standards Track [Page 4]</span><span id="page-5" ></span>
<span class="grey"><a href="./rfc3698">RFC 3698</a> LDAP: Additional Matching Rules February 2004</span>
<span class="h3"><a class="selflink" id="section-2.9" href="#section-2.9">2.9</a>. numericStringOrderingMatch</span>
The numericStringOrderingMatch rule compares the collation order of
the asserted string with an attribute value of NumericString syntax.
The rule is identical to the caseIgnoreOrderingMatch [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>] rule
except that all space characters are skipped during comparison (case
is irrelevant as characters are numeric). (Source: X.520)
( 2.5.13.9 NAME 'numericStringOrderingMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )
The NumericString (1.3.6.1.4.1.1466.115.121.1.36) syntax is described
in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.10" href="#section-2.10">2.10</a>. octetStringOrderingMatch</span>
The octetStringOrderingMatch rule compares the collation order of the
asserted octet string with an attribute value of OCTET STRING syntax.
The rule compares octet strings from first octet to last octet, and
from the most significant bit to the least significant bit within the
octet. The first occurrence of a different bit determines the
ordering of the strings. A zero bit precedes a one bit. If the
strings are identical but contain different numbers of octets, the
shorter string precedes the longer string. (Source: X.520)
( 2.5.13.18 NAME 'octetStringOrderingMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
The OCTET STRING (1.3.6.1.4.1.1466.115.121.1.40) syntax is described
in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.11" href="#section-2.11">2.11</a>. storedPrefixMatch</span>
The storedPrefixMatch rule determines whether an attribute value,
whose syntax is DirectoryString is a prefix (i.e., initial substring)
of the asserted value, without regard to the case (upper or lower) of
the strings. The rule returns TRUE if and only if the attribute
value is an initial substring of the asserted value with
corresponding characters identical except possibly with regard to
case. (Source: X.520)
( 2.5.13.41 NAME 'storedPrefixMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
<span class="grey">Zeilenga Standards Track [Page 5]</span><span id="page-6" ></span>
<span class="grey"><a href="./rfc3698">RFC 3698</a> LDAP: Additional Matching Rules February 2004</span>
Note: This rule can be used, for example, to compare values in the
Directory which are telephone area codes with a purported value
which is a telephone number.
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax is
described in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h3"><a class="selflink" id="section-2.12" href="#section-2.12">2.12</a>. wordMatch</span>
The wordMatch rule compares the asserted string with words in an
attribute value of DirectoryString syntax. The rule returns TRUE if
and only if the asserted word matches any word in the attribute
value. Individual word matching is as for the caseIgnoreMatch
[<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>] matching rule. The precise definition of a "word" is
implementation specific. (Source: X.520)
( 2.5.13.32 NAME 'wordMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax is
described in [<a href="./rfc2252" title=""Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions"">RFC2252</a>].
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Security Considerations</span>
General LDAP security considerations [<a href="./rfc3377" title=""Lightweight Directory Access Protocol (v3): Technical Specification"">RFC3377</a>] is applicable to the
use of this schema. Additional considerations are noted above where
appropriate.
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. IANA Considerations</span>
The Internet Assigned Numbers Authority (IANA) has updated the LDAP
descriptors registry [<a href="./rfc3383" title=""IANA Considerations for LDAP"">RFC3383</a>] as indicated in the following
template:
Subject: Request for LDAP Descriptor Registration Update
Descriptor (short name): see comment
Object Identifier: see comments
Person & email address to contact for further information:
Kurt Zeilenga <kurt@OpenLDAP.org>
Usage: see comments
Specification: <a href="./rfc3698">RFC 3698</a>
Author/Change Controller: IESG
Comments:
<span class="grey">Zeilenga Standards Track [Page 6]</span><span id="page-7" ></span>
<span class="grey"><a href="./rfc3698">RFC 3698</a> LDAP: Additional Matching Rules February 2004</span>
The following descriptors have been added:
NAME Type OID
------------------------ ---- ---------
booleanMatch M 2.5.13.13
caseExactMatch M 2.5.13.5
caseExactOrderingMatch M 2.5.13.6
caseExactSubstringsMatch M 2.5.13.7
caseIgnoreListSubstringsMatch M 2.5.13.12
directoryStringFirstComponentMatch M 2.5.13.31
integerOrderingMatch M 2.5.13.15
keywordMatch M 2.5.13.33
numericStringOrderingMatch M 2.5.13.9
octetStringOrderingMatch M 2.5.13.18
storedPrefixMatch M 2.5.13.41
wordMatch M 2.5.13.32
where Type M is Matching Rule.
This document makes no new OID assignments. It only associates LDAP
matching rule descriptions with existing X.500 matching rules.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Acknowledgments</span>
This document borrows from [<a href="#ref-X.520" title=""The Directory: Selected Attribute Types"">X.520</a>], an ITU-T Recommendation.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. References</span>
<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a>. Normative References</span>
[<a id="ref-RFC2252">RFC2252</a>] Wahl, M., Coulbeck, A., Howes, T. and S. Kille,
"Lightweight Directory Access Protocol (v3): Attribute
Syntax Definitions", <a href="./rfc2252">RFC 2252</a>, December 1997.
[<a id="ref-RFC3377">RFC3377</a>] Hodges, J. and R. Morgan, "Lightweight Directory Access
Protocol (v3): Technical Specification", <a href="./rfc3377">RFC 3377</a>,
September 2002.
<span class="h3"><a class="selflink" id="section-6.2" href="#section-6.2">6.2</a>. Informative References</span>
[<a id="ref-RFC2798">RFC2798</a>] Smith, M., "The LDAP inetOrgPerson Object Class", <a href="./rfc2798">RFC</a>
<a href="./rfc2798">2798</a>, April 2000.
[<a id="ref-RFC3383">RFC3383</a>] Zeilenga, K., "IANA Considerations for LDAP", <a href="https://www.rfc-editor.org/bcp/bcp64">BCP 64</a>
<a href="./rfc3383">RFC 3383</a>, September 2002.
[<a id="ref-RFC3703">RFC3703</a>] Strassner, J., Moore, B., Moats, R. and E. Ellesson,
"Policy Core LDAP Schema", <a href="./rfc3703">RFC 3703</a>, February 2004.
<span class="grey">Zeilenga Standards Track [Page 7]</span><span id="page-8" ></span>
<span class="grey"><a href="./rfc3698">RFC 3698</a> LDAP: Additional Matching Rules February 2004</span>
[<a id="ref-X.500">X.500</a>] International Telecommunication Union -
Telecommunication Standardization Sector, "The
Directory -- Overview of concepts, models and
services," X.500(1993) (also ISO/IEC 9594-1:1994).
[<a id="ref-X.520">X.520</a>] International Telecommunication Union -
Telecommunication Standardization Sector, "The
Directory: Selected Attribute Types", X.520(1997).
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. Author's Address</span>
Kurt D. Zeilenga
OpenLDAP Foundation
EMail: [email protected]
<span class="grey">Zeilenga Standards Track [Page 8]</span><span id="page-9" ></span>
<span class="grey"><a href="./rfc3698">RFC 3698</a> LDAP: Additional Matching Rules February 2004</span>
<span class="h2"><a class="selflink" id="section-8" href="#section-8">8</a>. Full Copyright Statement</span>
Copyright (C) The Internet Society (2004). This document is subject
to the rights, licenses and restrictions contained in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and
except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE
INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed
to pertain to the implementation or use of the technology
described in this document or the extent to which any license
under such rights might or might not be available; nor does it
represent that it has made any independent effort to identify any
such rights. Information on the procedures with respect to
rights in RFC documents can be found in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and <a href="https://www.rfc-editor.org/bcp/bcp79">BCP 79</a>.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use
of such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository
at <a href="http://www.ietf.org/ipr">http://www.ietf.org/ipr</a>.
The IETF invites any interested party to bring to its attention
any copyrights, patents or patent applications, or other
proprietary rights that may cover technology that may be required
to implement this standard. Please address the information to the
IETF at [email protected].
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
Zeilenga Standards Track [Page 9]
Annotations
Select text to annotate