4524
PROPOSED STANDARD
COSINE LDAP/X.500 Schema
Authors: K. Zeilenga
Date: June 2006
Working Group: NON WORKING GROUP
Stream: IETF
Abstract
This document provides a collection of schema elements for use with the Lightweight Directory Access Protocol (LDAP) from the COSINE and Internet X.500 pilot projects.
This document obsoletes RFC 1274 and updates RFCs 2247 and 2798. [STANDARDS-TRACK]
RFC 4524
PROPOSED STANDARD
Errata Exist
Network Working Group K. Zeilenga, Ed.
Request for Comments: 4524 OpenLDAP Foundation
Obsoletes: <a href="./rfc1274">1274</a> June 2006
Updates: <a href="./rfc2247">2247</a>, <a href="./rfc2798">2798</a>
Category: Standards Track
<span class="h1">COSINE LDAP/X.500 Schema</span>
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
This document provides a collection of schema elements for use with
the Lightweight Directory Access Protocol (LDAP) from the COSINE and
Internet X.500 pilot projects.
This document obsoletes <a href="./rfc1274">RFC 1274</a> and updates RFCs 2247 and 2798.
Table of Contents
<a href="#section-1">1</a>. Introduction ....................................................<a href="#page-3">3</a>
<a href="#section-1.1">1.1</a>. Relationship to Other Documents ............................<a href="#page-3">3</a>
<a href="#section-1.2">1.2</a>. Terminology and Conventions ................................<a href="#page-4">4</a>
<a href="#section-2">2</a>. COSINE Attribute Types ..........................................<a href="#page-4">4</a>
<a href="#section-2.1">2.1</a>. associatedDomain ...........................................<a href="#page-4">4</a>
<a href="#section-2.2">2.2</a>. associatedName .............................................<a href="#page-5">5</a>
<a href="#section-2.3">2.3</a>. buildingName ...............................................<a href="#page-5">5</a>
<a href="#section-2.4">2.4</a>. co .........................................................<a href="#page-5">5</a>
<a href="#section-2.5">2.5</a>. documentAuthor .............................................<a href="#page-6">6</a>
<a href="#section-2.6">2.6</a>. documentIdentifier .........................................<a href="#page-6">6</a>
<a href="#section-2.7">2.7</a>. documentLocation ...........................................<a href="#page-6">6</a>
<a href="#section-2.8">2.8</a>. documentPublisher ..........................................<a href="#page-7">7</a>
<a href="#section-2.9">2.9</a>. documentTitle ..............................................<a href="#page-7">7</a>
<a href="#section-2.10">2.10</a>. documentVersion ...........................................<a href="#page-7">7</a>
<a href="#section-2.11">2.11</a>. drink .....................................................<a href="#page-8">8</a>
<a href="#section-2.12">2.12</a>. homePhone .................................................<a href="#page-8">8</a>
<a href="#section-2.13">2.13</a>. homePostalAddress .........................................<a href="#page-8">8</a>
<span class="grey">Zeilenga Standards Track [Page 1]</span><span id="page-2" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
<a href="#section-2.14">2.14</a>. host ......................................................<a href="#page-9">9</a>
<a href="#section-2.15">2.15</a>. info ......................................................<a href="#page-9">9</a>
<a href="#section-2.16">2.16</a>. mail ......................................................<a href="#page-9">9</a>
<a href="#section-2.17">2.17</a>. manager ..................................................<a href="#page-10">10</a>
<a href="#section-2.18">2.18</a>. mobile ...................................................<a href="#page-10">10</a>
<a href="#section-2.19">2.19</a>. organizationalStatus .....................................<a href="#page-11">11</a>
<a href="#section-2.20">2.20</a>. pager ....................................................<a href="#page-11">11</a>
<a href="#section-2.21">2.21</a>. personalTitle ............................................<a href="#page-11">11</a>
<a href="#section-2.22">2.22</a>. roomNumber ...............................................<a href="#page-12">12</a>
<a href="#section-2.23">2.23</a>. secretary ................................................<a href="#page-12">12</a>
<a href="#section-2.24">2.24</a>. uniqueIdentifier .........................................<a href="#page-12">12</a>
<a href="#section-2.25">2.25</a>. userClass ................................................<a href="#page-13">13</a>
<a href="#section-3">3</a>. COSINE Object Classes ..........................................<a href="#page-13">13</a>
<a href="#section-3.1">3.1</a>. account ...................................................<a href="#page-13">13</a>
<a href="#section-3.2">3.2</a>. document ..................................................<a href="#page-14">14</a>
<a href="#section-3.3">3.3</a>. documentSeries ............................................<a href="#page-14">14</a>
<a href="#section-3.4">3.4</a>. domain ....................................................<a href="#page-15">15</a>
<a href="#section-3.5">3.5</a>. domainRelatedObject .......................................<a href="#page-16">16</a>
<a href="#section-3.6">3.6</a>. friendlyCountry ...........................................<a href="#page-16">16</a>
<a href="#section-3.7">3.7</a>. rFC822LocalPart ...........................................<a href="#page-17">17</a>
<a href="#section-3.8">3.8</a>. room ......................................................<a href="#page-18">18</a>
<a href="#section-3.9">3.9</a>. simpleSecurityObject ......................................<a href="#page-18">18</a>
<a href="#section-4">4</a>. Security Considerations ........................................<a href="#page-18">18</a>
<a href="#section-5">5</a>. IANA Considerations ............................................<a href="#page-19">19</a>
<a href="#section-6">6</a>. Acknowledgements ...............................................<a href="#page-20">20</a>
<a href="#section-7">7</a>. References .....................................................<a href="#page-20">20</a>
<a href="#section-7.1">7.1</a>. Normative References ......................................<a href="#page-20">20</a>
<a href="#section-7.2">7.2</a>. Informative References ....................................<a href="#page-21">21</a>
<a href="#appendix-A">Appendix A</a>. Changes since <a href="./rfc1274">RFC 1274</a> ...............................<a href="#page-23">23</a>
<a href="#appendix-A.1">A.1</a>. LDAP Short Names .........................................<a href="#page-23">23</a>
<a href="#appendix-A.2">A.2</a>. pilotObject ..............................................<a href="#page-23">23</a>
<a href="#appendix-A.3">A.3</a>. pilotPerson ..............................................<a href="#page-23">23</a>
<a href="#appendix-A.4">A.4</a>. dNSDomain ................................................<a href="#page-24">24</a>
<a href="#appendix-A.5">A.5</a>. pilotDSA and qualityLabelledData .........................<a href="#page-24">24</a>
<a href="#appendix-A.6">A.6</a>. Attribute Syntaxes .......................................<a href="#page-24">24</a>
<a href="#appendix-B">Appendix B</a>. Changes since <a href="./rfc2247">RFC 2247</a> ...............................<a href="#page-24">24</a>
<span class="grey">Zeilenga Standards Track [Page 2]</span><span id="page-3" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
In the late 1980s, X.500 Directory Services were standardized by the
CCITT (Commite' Consultatif International de Telegraphique et
Telephonique), now a part of the ITU (International Telephone Union).
This lead to Directory Service piloting activities in the early
1990s, including the COSINE (Co-operation and Open Systems
Interconnection in Europe) PARADISE Project pilot [<a href="#ref-COSINEpilot" title=""PARADISE"">COSINEpilot</a>] in
Europe. Motivated by needs for large-scale directory pilots, <a href="./rfc1274">RFC</a>
<a href="./rfc1274">1274</a> was published to standardize the directory schema and naming
architecture for use in the COSINE and other Internet X.500 pilots
[<a href="./rfc1274" title=""The COSINE and Internet X.500 Schema"">RFC1274</a>].
In the years that followed, X.500 Directory Services have evolved to
incorporate new capabilities and even new protocols. In particular,
the Lightweight Directory Access Protocol (LDAP) [<a href="./rfc4510" title=""Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map"">RFC4510</a>] was
introduced in the early 1990s [<a href="./rfc1487" title=""X.500 Lightweight Directory Access Protocol"">RFC1487</a>], with Version 3 of LDAP
introduced in the late 1990s [<a href="./rfc2251" title=""Lightweight Directory Access Protocol (v3)"">RFC2251</a>] and subsequently revised in
2005 [<a href="./rfc4510" title=""Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map"">RFC4510</a>].
While much of the material in <a href="./rfc1274">RFC 1274</a> has been superceded by
subsequently published ITU-T Recommendations and IETF RFCs, many of
the schema elements lack standardized schema descriptions for use in
modern X.500 and LDAP directory services despite the fact that these
schema elements are in wide use today. As the old schema
descriptions cannot be used without adaptation, interoperability
issues may arise due to lack of standardized modern schema
descriptions.
This document addresses these issues by offering standardized schema
descriptions, where needed, for widely used COSINE schema elements.
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Relationship to Other Documents</span>
This document, together with [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>] and [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>], obsoletes <a href="./rfc1274">RFC</a>
<a href="./rfc1274">1274</a> in its entirety. [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>] replaces Sections <a href="#section-9.3.1">9.3.1</a> (Userid) and
9.3.21 (Domain Component) of <a href="./rfc1274">RFC 1274</a>. [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>] replaces <a href="#section-9.4">Section</a>
<a href="#section-9.4">9.4</a> (Generally useful syntaxes) of <a href="./rfc1274">RFC 1274</a>.
This document replaces the remainder of <a href="./rfc1274">RFC 1274</a>. <a href="#appendix-A">Appendix A</a>
discusses changes since <a href="./rfc1274">RFC 1274</a>, as well as why certain schema
elements were not brought forward in this revision of the COSINE
schema. All elements not brought are to be regarded as Historic.
The description of the 'domain' object class provided in this
document supercedes that found in <a href="./rfc2247">RFC 2247</a>. That is, <a href="#section-3.4">Section 3.4</a> of
this document replaces <a href="./rfc2247#section-5.2">Section 5.2 of [RFC2247]</a>.
<span class="grey">Zeilenga Standards Track [Page 3]</span><span id="page-4" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
Some of the schema elements specified here were described in <a href="./rfc2798">RFC 2798</a>
(inetOrgPerson schema). This document supersedes these descriptions.
This document, together with [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>], replaces Section 9.1.3 of <a href="./rfc2798">RFC</a>
<a href="./rfc2798">2798</a>.
<span class="h3"><a class="selflink" id="section-1.2" href="#section-1.2">1.2</a>. Terminology and Conventions</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a> [<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
DIT stands for Directory Information Tree.
DN stands for Distinguished Name.
DSA stands for Directory System Agent, a server.
DSE stands for DSA-Specific Entry.
DUA stands for Directory User Agent, a client.
These terms are discussed in [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>].
Schema definitions are provided using LDAP description formats
[<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]. Definitions provided here are formatted (line wrapped)
for readability.
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. COSINE Attribute Types</span>
This section details COSINE attribute types for use in LDAP.
<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>. associatedDomain</span>
The 'associatedDomain' attribute specifies DNS [<a href="./rfc1034" title=""Domain names - concepts and facilities"">RFC1034</a>][RFC2181]
host names [<a href="./rfc1123" title=""Requirements for Internet Hosts - Application and Support"">RFC1123</a>] that are associated with an object. That is,
values of this attribute should conform to the following ABNF:
domain = root / label *( DOT label )
root = SPACE
label = LETDIG [ *61( LETDIG / HYPHEN ) LETDIG ]
LETDIG = %x30-39 / %x41-5A / %x61-7A ; "0" - "9" / "A"-"Z" / "a"-"z"
SPACE = %x20 ; space (" ")
HYPHEN = %x2D ; hyphen ("-")
DOT = %x2E ; period (".")
For example, the entry in the DIT with a DN <DC=example,DC=com> might
have an associated domain of "example.com".
( 0.9.2342.19200300.100.1.37 NAME 'associatedDomain'
EQUALITY caseIgnoreIA5Match
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
<span class="grey">Zeilenga Standards Track [Page 4]</span><span id="page-5" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
The IA5String (1.3.6.1.4.1.1466.115.121.1.26) syntax and the
'caseIgnoreIA5Match' and 'caseIgnoreIA5SubstringsMatch' rules are
described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
Note that the directory will not ensure that values of this attribute
conform to the <domain> production provided above. It is the
application's responsibility to ensure that domains it stores in this
attribute are appropriately represented.
Also note that applications supporting Internationalized Domain Names
SHALL use the ToASCII method [<a href="./rfc3490" title=""Internationalizing Domain Names in Applications (IDNA)"">RFC3490</a>] to produce <label> components
of the <domain> production.
<span class="h3"><a class="selflink" id="section-2.2" href="#section-2.2">2.2</a>. associatedName</span>
The 'associatedName' attribute specifies names of entries in the
organizational DIT associated with a DNS domain [<a href="./rfc1034" title=""Domain names - concepts and facilities"">RFC1034</a>][RFC2181].
( 0.9.2342.19200300.100.1.38 NAME 'associatedName'
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
The DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax and the
'distinguishedNameMatch' rule are described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.3" href="#section-2.3">2.3</a>. buildingName</span>
The 'buildingName' attribute specifies names of the buildings where
an organization or organizational unit is based, for example, "The
White House".
( 0.9.2342.19200300.100.1.48 NAME 'buildingName'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.4" href="#section-2.4">2.4</a>. co</span>
The 'co' (Friendly Country Name) attribute specifies names of
countries in human-readable format, for example, "Germany" and
"Federal Republic of Germany". It is commonly used in conjunction
with the 'c' (Country Name) [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>] attribute (whose values are
restricted to the two-letter codes defined in [<a href="#ref-ISO3166" title=""Codes for the representation of names of countries"">ISO3166</a>]).
<span class="grey">Zeilenga Standards Track [Page 5]</span><span id="page-6" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
( 0.9.2342.19200300.100.1.43 NAME 'co'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.5" href="#section-2.5">2.5</a>. documentAuthor</span>
The 'documentAuthor' attribute specifies the distinguished names of
authors (or editors) of a document. For example,
( 0.9.2342.19200300.100.1.14 NAME 'documentAuthor'
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
The DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax and the
'distinguishedNameMatch' rule are described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.6" href="#section-2.6">2.6</a>. documentIdentifier</span>
The 'documentIdentifier' attribute specifies unique identifiers for a
document. A document may be identified by more than one unique
identifier. For example, <a href="./rfc3383">RFC 3383</a> and <a href="https://www.rfc-editor.org/bcp/bcp64">BCP 64</a> are unique identifiers
that (presently) refer to the same document.
( 0.9.2342.19200300.100.1.11 NAME 'documentIdentifier'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.7" href="#section-2.7">2.7</a>. documentLocation</span>
The 'documentLocation' attribute specifies locations of the document
original.
( 0.9.2342.19200300.100.1.15 NAME 'documentLocation'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
<span class="grey">Zeilenga Standards Track [Page 6]</span><span id="page-7" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.8" href="#section-2.8">2.8</a>. documentPublisher</span>
The 'documentPublisher' attribute is the persons and/or organizations
that published the document. Documents that are jointly published
have one value for each publisher.
( 0.9.2342.19200300.100.1.56 NAME 'documentPublisher'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.9" href="#section-2.9">2.9</a>. documentTitle</span>
The 'documentTitle' attribute specifies the titles of a document.
Multiple values are allowed to accommodate both long and short
titles, or other situations where a document has multiple titles, for
example, "The Lightweight Directory Access Protocol Technical
Specification" and "The LDAP Technical Specification".
( 0.9.2342.19200300.100.1.12 NAME 'documentTitle'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.10" href="#section-2.10">2.10</a>. documentVersion</span>
The 'documentVersion' attribute specifies the version information of
a document.
( 0.9.2342.19200300.100.1.13 NAME 'documentVersion'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
<span class="grey">Zeilenga Standards Track [Page 7]</span><span id="page-8" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.11" href="#section-2.11">2.11</a>. drink</span>
The 'drink' (favoriteDrink) attribute specifies the favorite drinks
of an object (or person), for instance, "cola" and "beer".
( 0.9.2342.19200300.100.1.5 NAME 'drink'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.12" href="#section-2.12">2.12</a>. homePhone</span>
The 'homePhone' (Home Telephone Number) attribute specifies home
telephone numbers (e.g., "+1 775 555 1234") associated with a person.
( 0.9.2342.19200300.100.1.20 NAME 'homePhone'
EQUALITY telephoneNumberMatch
SUBSTR telephoneNumberSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )
The telephoneNumber (1.3.6.1.4.1.1466.115.121.1.50) syntax and the
'telephoneNumberMatch' and 'telephoneNumberSubstringsMatch' rules are
described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.13" href="#section-2.13">2.13</a>. homePostalAddress</span>
The 'homePostalAddress' attribute specifies home postal addresses for
an object. Each value should be limited to up to 6 directory strings
of 30 characters each. (Note: It is not intended that the directory
service enforce these limits.)
( 0.9.2342.19200300.100.1.39 NAME 'homePostalAddress'
EQUALITY caseIgnoreListMatch
SUBSTR caseIgnoreListSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )
The PostalAddress (1.3.6.1.4.1.1466.115.121.1.41) syntax and the
'caseIgnoreListMatch' and 'caseIgnoreListSubstringsMatch' rules are
described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="grey">Zeilenga Standards Track [Page 8]</span><span id="page-9" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
<span class="h3"><a class="selflink" id="section-2.14" href="#section-2.14">2.14</a>. host</span>
The 'host' attribute specifies host computers, generally by their
primary fully qualified domain name (e.g., my-host.example.com).
( 0.9.2342.19200300.100.1.9 NAME 'host'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.15" href="#section-2.15">2.15</a>. info</span>
The 'info' attribute specifies any general information pertinent to
an object. This information is not necessarily descriptive of the
object.
Applications should not attach specific semantics to values of this
attribute. The 'description' attribute [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>] is available for
specifying descriptive information pertinent to an object.
( 0.9.2342.19200300.100.1.4 NAME 'info'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{2048} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.16" href="#section-2.16">2.16</a>. mail</span>
The 'mail' (rfc822mailbox) attribute type holds Internet mail
addresses in Mailbox [<a href="./rfc2821" title=""Simple Mail Transfer Protocol"">RFC2821</a>] form (e.g., [email protected]).
( 0.9.2342.19200300.100.1.3 NAME 'mail'
EQUALITY caseIgnoreIA5Match
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
The IA5String (1.3.6.1.4.1.1466.115.121.1.26) syntax and the
'caseIgnoreIA5Match' and 'caseIgnoreIA5SubstringsMatch' rules are
described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="grey">Zeilenga Standards Track [Page 9]</span><span id="page-10" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
Note that the directory will not ensure that values of this attribute
conform to the <Mailbox> production [<a href="./rfc2821" title=""Simple Mail Transfer Protocol"">RFC2821</a>]. It is the
application's responsibility to ensure that domains it stores in this
attribute are appropriately represented.
Additionally, the directory will compare values per the matching
rules named in the above attribute type description. As these rules
differ from rules that normally apply to <Mailbox> comparisons,
operational issues may arise. For example, the assertion
([email protected]) will match "[email protected]" even though the
<local-parts> differ. Also, where a user has two <Mailbox>es whose
addresses differ only by case of the <local-part>, both cannot be
listed as values of the user's mail attribute (as they are considered
equal by the 'caseIgnoreIA5Match' rule).
Also note that applications supporting internationalized domain names
SHALL use the ToASCII method [<a href="./rfc3490" title=""Internationalizing Domain Names in Applications (IDNA)"">RFC3490</a>] to produce <sub-domain>
components of the <Mailbox> production.
<span class="h3"><a class="selflink" id="section-2.17" href="#section-2.17">2.17</a>. manager</span>
The 'manager' attribute specifies managers, by distinguished name, of
the person (or entity).
( 0.9.2342.19200300.100.1.10 NAME 'manager'
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
The DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax and the
'distinguishedNameMatch' rule are described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.18" href="#section-2.18">2.18</a>. mobile</span>
The 'mobile' (mobileTelephoneNumber) attribute specifies mobile
telephone numbers (e.g., "+1 775 555 6789") associated with a person
(or entity).
( 0.9.2342.19200300.100.1.41 NAME 'mobile'
EQUALITY telephoneNumberMatch
SUBSTR telephoneNumberSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )
The telephoneNumber (1.3.6.1.4.1.1466.115.121.1.50) syntax and the
'telephoneNumberMatch' and 'telephoneNumberSubstringsMatch' rules are
described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="grey">Zeilenga Standards Track [Page 10]</span><span id="page-11" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
<span class="h3"><a class="selflink" id="section-2.19" href="#section-2.19">2.19</a>. organizationalStatus</span>
The 'organizationalStatus' attribute specifies categories by which a
person is often referred to in an organization. Examples of usage in
academia might include "undergraduate student", "researcher",
"professor", and "staff". Multiple values are allowed where the
person is in multiple categories.
Directory administrators and application designers SHOULD consider
carefully the distinctions between this and the 'title' and
'userClass' attributes.
( 0.9.2342.19200300.100.1.45 NAME 'organizationalStatus'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.20" href="#section-2.20">2.20</a>. pager</span>
The 'pager' (pagerTelephoneNumber) attribute specifies pager
telephone numbers (e.g., "+1 775 555 5555") for an object.
( 0.9.2342.19200300.100.1.42 NAME 'pager'
EQUALITY telephoneNumberMatch
SUBSTR telephoneNumberSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )
The telephoneNumber (1.3.6.1.4.1.1466.115.121.1.50) syntax and the
'telephoneNumberMatch' and 'telephoneNumberSubstringsMatch' rules are
described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.21" href="#section-2.21">2.21</a>. personalTitle</span>
The 'personalTitle' attribute specifies personal titles for a person.
Examples of personal titles are "Frau", "Dr.", "Herr", and
"Professor".
( 0.9.2342.19200300.100.1.40 NAME 'personalTitle'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
<span class="grey">Zeilenga Standards Track [Page 11]</span><span id="page-12" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.22" href="#section-2.22">2.22</a>. roomNumber</span>
The 'roomNumber' attribute specifies the room number of an object.
During periods of renumbering, or in other circumstances where a room
has multiple valid room numbers associated with it, multiple values
may be provided. Note that the 'cn' (commonName) attribute type
SHOULD be used for naming room objects.
( 0.9.2342.19200300.100.1.6 NAME 'roomNumber'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.23" href="#section-2.23">2.23</a>. secretary</span>
The 'secretary' attribute specifies secretaries and/or administrative
assistants, by distinguished name.
( 0.9.2342.19200300.100.1.21 NAME 'secretary'
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
The DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax and the
'distinguishedNameMatch' rule are described in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h3"><a class="selflink" id="section-2.24" href="#section-2.24">2.24</a>. uniqueIdentifier</span>
The 'uniqueIdentifier' attribute specifies a unique identifier for an
object represented in the Directory. The domain within which the
identifier is unique and the exact semantics of the identifier are
for local definition. For a person, this might be an institution-
wide payroll number. For an organizational unit, it might be a
department code.
( 0.9.2342.19200300.100.1.44 NAME 'uniqueIdentifier'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
<span class="grey">Zeilenga Standards Track [Page 12]</span><span id="page-13" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
Note: X.520 also describes an attribute called 'uniqueIdentifier'
(2.5.4.45), which is called 'x500UniqueIdentifier' in LDAP
[<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>]. The attribute detailed here ought not be confused
with 'x500UniqueIdentifier'.
<span class="h3"><a class="selflink" id="section-2.25" href="#section-2.25">2.25</a>. userClass</span>
The 'userClass' attribute specifies categories of computer or
application user. The semantics placed on this attribute are for
local interpretation. Examples of current usage of this attribute in
academia are "student", "staff", and "faculty". Note that the
'organizationalStatus' attribute type is now often preferred, as it
makes no distinction between persons as opposed to users.
( 0.9.2342.19200300.100.1.8 NAME 'userClass'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
The DirectoryString (1.3.6.1.4.1.1466.115.121.1.15) syntax and the
'caseIgnoreMatch' and 'caseIgnoreSubstringsMatch' rules are described
in [<a href="./rfc4517" title=""Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules"">RFC4517</a>].
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. COSINE Object Classes</span>
This section details COSINE object classes for use in LDAP.
<span class="h3"><a class="selflink" id="section-3.1" href="#section-3.1">3.1</a>. account</span>
The 'account' object class is used to define entries representing
computer accounts. The 'uid' attribute SHOULD be used for naming
entries of this object class.
( 0.9.2342.19200300.100.4.5 NAME 'account'
SUP top STRUCTURAL
MUST uid
MAY ( description $ seeAlso $ l $ o $ ou $ host ) )
The 'top' object class is described in [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]. The 'description',
'seeAlso', 'l', 'o', 'ou', and 'uid' attribute types are described in
[<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>]. The 'host' attribute type is described in <a href="#section-2">Section 2</a> of
this document.
<span class="grey">Zeilenga Standards Track [Page 13]</span><span id="page-14" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
3.3. documentSeriesExample:
dn: uid=kdz,cn=Accounts,dc=Example,dc=COM
objectClass: account
uid: kdz
seeAlso: cn=Kurt D. Zeilenga,cn=Persons,dc=Example,dc=COM
<span class="h3"><a class="selflink" id="section-3.2" href="#section-3.2">3.2</a>. document</span>
The 'document' object class is used to define entries that represent
documents.
( 0.9.2342.19200300.100.4.6 NAME 'document'
SUP top STRUCTURAL
MUST documentIdentifier
MAY ( cn $ description $ seeAlso $ l $ o $ ou $
documentTitle $ documentVersion $ documentAuthor $
documentLocation $ documentPublisher ) )
The 'top' object class is described in [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]. The 'cn',
'description', 'seeAlso', 'l', 'o', and 'ou' attribute types are
described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>]. The 'documentIdentifier', 'documentTitle',
'documentVersion', 'documentAuthor', 'documentLocation', and
'documentPublisher' attribute types are described in <a href="#section-2">Section 2</a> of
this document.
Example:
dn: documentIdentifier=<a href="./rfc4524">RFC 4524</a>,cn=RFC,dc=Example,dc=COM
objectClass: document
documentIdentifier: <a href="./rfc4524">RFC 4524</a>
documentTitle: COSINE LDAP/X.500 Schema
documentAuthor: cn=Kurt D. Zeilenga,cn=Persons,dc=Example,dc=COM
documentLocation: <a href="https://www.rfc-editor.org/rfc/rfc4524.txt">http://www.rfc-editor.org/rfc/rfc4524.txt</a>
documentPublisher: Internet Engineering Task Force
description: A collection of schema elements for use in LDAP
description: Obsoletes <a href="./rfc1274">RFC 1274</a>
seeAlso: documentIdentifier=<a href="./rfc4510">RFC 4510</a>,cn=RFC,dc=Example,dc=COM
seeAlso: documentIdentifier=<a href="./rfc1274">RFC 1274</a>,cn=RFC,dc=Example,dc=COM
<span class="h3"><a class="selflink" id="section-3.3" href="#section-3.3">3.3</a>. documentSeries</span>
The 'documentSeries' object class is used to define an entry that
represents a series of documents (e.g., The Request For Comments
memos).
<span class="grey">Zeilenga Standards Track [Page 14]</span><span id="page-15" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
( 0.9.2342.19200300.100.4.9 NAME 'documentSeries'
SUP top STRUCTURAL
MUST cn
MAY ( description $ l $ o $ ou $ seeAlso $
telephonenumber ) )
The 'top' object class is described in [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]. The 'description',
'l', 'o', 'ou', 'seeAlso', and 'telephoneNumber' attribute types are
described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>].
Example:
dn: cn=RFC,dc=Example,dc=COM
objectClass: documentSeries
cn: Request for Comments
cn: RFC
description: a series of memos about the Internet
<span class="h3"><a class="selflink" id="section-3.4" href="#section-3.4">3.4</a>. domain</span>
The 'domain' object class is used to define entries that represent
DNS domains for objects that are not organizations, organizational
units, or other kinds of objects more appropriately defined using an
object class specific to the kind of object being defined (e.g.,
'organization', 'organizationUnit').
The 'dc' attribute should be used for naming entries of the 'domain'
object class.
( 0.9.2342.19200300.100.4.13 NAME 'domain'
SUP top STRUCTURAL
MUST dc
MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $
teletexTerminalIdentifier $ telephoneNumber $
internationaliSDNNumber $ facsimileTelephoneNumber $ street $
postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ st $ l $ description $ o $
associatedName ) )
The 'top' object class and the 'dc', 'userPassword', 'searchGuide',
'seeAlso', 'businessCategory', 'x121Address', 'registeredAddress',
'destinationIndicator', 'preferredDeliveryMethod', 'telexNumber',
'teletexTerminalIdentifier', 'telephoneNumber',
'internationaliSDNNumber', 'facsimileTelephoneNumber', 'street',
'postOfficeBox', 'postalCode', 'postalAddress',
'physicalDeliveryOfficeName', 'st', 'l', 'description', and 'o' types
<span class="grey">Zeilenga Standards Track [Page 15]</span><span id="page-16" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
are described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>]. The 'associatedName' attribute type is
described in <a href="#section-2">Section 2</a> of this document.
Example:
dn: dc=com
objectClass: domain
dc: com
description: the .COM TLD
<span class="h3"><a class="selflink" id="section-3.5" href="#section-3.5">3.5</a>. domainRelatedObject</span>
The 'domainRelatedObject' object class is used to define entries that
represent DNS domains that are "equivalent" to an X.500 domain, e.g.,
an organization or organizational unit.
( 0.9.2342.19200300.100.4.17 NAME 'domainRelatedObject'
SUP top AUXILIARY
MUST associatedDomain )
The 'top' object class is described in [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]. The
'associatedDomain' attribute type is described in <a href="#section-2">Section 2</a> of this
document.
Example:
dn: dc=example,dc=com
objectClass: organization
objectClass: dcObject
objectClass: domainRelatedObject
dc: example
associatedDomain: example.com
o: Example Organization
The 'organization' and 'dcObject' object classes and the 'dc' and 'o'
attribute types are described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>].
<span class="h3"><a class="selflink" id="section-3.6" href="#section-3.6">3.6</a>. friendlyCountry</span>
The 'friendlyCountry' object class is used to define entries
representing countries in the DIT. The object class is used to allow
friendlier naming of countries than that allowed by the object class
'country' [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>].
( 0.9.2342.19200300.100.4.18 NAME 'friendlyCountry'
SUP country STRUCTURAL
MUST co )
<span class="grey">Zeilenga Standards Track [Page 16]</span><span id="page-17" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
The 'country' object class is described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>]. The 'co'
attribute type is described in <a href="#section-2">Section 2</a> of this document.
Example:
dn: c=DE
objectClass: country
objectClass: friendlyCountry
c: DE
co: Deutschland
co: Germany
co: Federal Republic of Germany
co: FRG
The 'c' attribute type is described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>].
<span class="h3"><a class="selflink" id="section-3.7" href="#section-3.7">3.7</a>. rFC822LocalPart</span>
The 'rFC822LocalPart' object class is used to define entries that
represent the local part of Internet mail addresses [<a href="./rfc2822" title=""Internet Message Format"">RFC2822</a>]. This
treats the local part of the address as a 'domain' object.
( 0.9.2342.19200300.100.4.14 NAME 'rFC822localPart'
SUP domain STRUCTURAL
MAY ( cn $ description $ destinationIndicator $
facsimileTelephoneNumber $ internationaliSDNNumber $
physicalDeliveryOfficeName $ postalAddress $ postalCode $
postOfficeBox $ preferredDeliveryMethod $ registeredAddress $
seeAlso $ sn $ street $ telephoneNumber $
teletexTerminalIdentifier $ telexNumber $ x121Address ) )
The 'domain' object class is described in <a href="#section-3.4">Section 3.4</a> of this
document. The 'cn', 'description', 'destinationIndicator',
'facsimileTelephoneNumber', 'internationaliSDNNumber,
'physicalDeliveryOfficeName', 'postalAddress', 'postalCode',
'postOfficeBox', 'preferredDeliveryMethod', 'registeredAddress',
'seeAlso', 'sn, 'street', 'telephoneNumber',
'teletexTerminalIdentifier', 'telexNumber', and 'x121Address'
attribute types are described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>].
Example:
dn: dc=kdz,dc=example,dc=com
objectClass: domain
objectClass: rFC822LocalPart
dc: kdz
associatedName: cn=Kurt D. Zeilenga,cn=Persons,dc=Example,dc=COM
<span class="grey">Zeilenga Standards Track [Page 17]</span><span id="page-18" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
The 'dc' attribute type is described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>].
<span class="h3"><a class="selflink" id="section-3.8" href="#section-3.8">3.8</a>. room</span>
The 'room' object class is used to define entries representing rooms.
The 'cn' (commonName) attribute SHOULD be used for naming entries of
this object class.
( 0.9.2342.19200300.100.4.7 NAME 'room'
SUP top STRUCTURAL
MUST cn
MAY ( roomNumber $ description $ seeAlso $ telephoneNumber ) )
The 'top' object class is described in [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]. The 'cn',
'description', 'seeAlso', and 'telephoneNumber' attribute types are
described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>]. The 'roomNumber' attribute type is described
in <a href="#section-2">Section 2</a> of this document.
dn: cn=conference room,dc=example,dc=com
objectClass: room
cn: conference room
telephoneNumber: +1 755 555 1111
<span class="h3"><a class="selflink" id="section-3.9" href="#section-3.9">3.9</a>. simpleSecurityObject</span>
The 'simpleSecurityObject' object class is used to require an entry
to have a 'userPassword' attribute when the entry's structural object
class does not require (or allow) the 'userPassword attribute'.
( 0.9.2342.19200300.100.4.19 NAME 'simpleSecurityObject'
SUP top AUXILIARY
MUST userPassword )
The 'top' object class is described in [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]. The 'userPassword'
attribute type is described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>].
dn: dc=kdz,dc=Example,dc=COM
objectClass: account
objectClass: simpleSecurityObject
uid: kdz
userPassword: My Password
seeAlso: cn=Kurt D. Zeilenga,cn=Persons,dc=Example,dc=COM
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Security Considerations</span>
General LDAP security considerations [<a href="./rfc4510" title=""Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map"">RFC4510</a>] are applicable to the
use of this schema. Additional considerations are noted above where
appropriate.
<span class="grey">Zeilenga Standards Track [Page 18]</span><span id="page-19" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
Directories administrators should ensure that access to sensitive
information be restricted to authorized entities and that appropriate
data security services, including data integrity and data
confidentiality, are used to protect against eavesdropping.
Simple authentication (e.g., plain text passwords) mechanisms should
only be used when adequate data security services are in place. LDAP
offers reasonably strong authentication and data security services
[<a href="./rfc4513" title=""Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms"">RFC4513</a>].
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. IANA Considerations</span>
The Internet Assigned Numbers Authority (IANA) has updated the LDAP
descriptors registry [<a href="./rfc4520" title=""Internet Assigned Numbers Authority (IANA) Considerations for the Lightweight Directory Access Protocol (LDAP)"">RFC4520</a>] as indicated in the following
template:
Subject: Request for LDAP Descriptor Registration Update
Descriptor (short name): see comment
Object Identifier: see comments
Person & email address to contact for further information:
Kurt Zeilenga <kurt@OpenLDAP.org>
Usage: see comments
Specification: <a href="./rfc4524">RFC 4524</a>
Author/Change Controller: IESG
Comments:
The following descriptors have been updated to refer to <a href="./rfc4524">RFC 4524</a>.
NAME Type OID
------------------------ ---- --------------------------
account O 0.9.2342.19200300.100.4.5
associatedDomain A 0.9.2342.19200300.100.1.37
associatedName A 0.9.2342.19200300.100.1.38
buildingName A 0.9.2342.19200300.100.1.48
co A 0.9.2342.19200300.100.1.43
document O 0.9.2342.19200300.100.4.6
documentAuthor A 0.9.2342.19200300.100.1.14
documentIdentifier A 0.9.2342.19200300.100.1.11
documentLocation A 0.9.2342.19200300.100.1.15
documentPublisher A 0.9.2342.19200300.100.1.56
documentSeries O 0.9.2342.19200300.100.4.8
documentTitle A 0.9.2342.19200300.100.1.12
documentVersion A 0.9.2342.19200300.100.1.13
domain O 0.9.2342.19200300.100.4.13
domainRelatedObject O 0.9.2342.19200300.100.4.17
drink A 0.9.2342.19200300.100.1.5
favouriteDrink A* 0.9.2342.19200300.100.1.5
friendlyCountry O 0.9.2342.19200300.100.4.18
<span class="grey">Zeilenga Standards Track [Page 19]</span><span id="page-20" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
friendlyCountryName A* 0.9.2342.19200300.100.1.43
homePhone A 0.9.2342.19200300.100.1.20
homePostalAddress A 0.9.2342.19200300.100.1.39
homeTelephone A* 0.9.2342.19200300.100.1.20
host A 0.9.2342.19200300.100.1.9
info A 0.9.2342.19200300.100.1.4
mail A 0.9.2342.19200300.100.1.3
manager A 0.9.2342.19200300.100.1.10
mobile A 0.9.2342.19200300.100.1.41
mobileTelephoneNumber A* 0.9.2342.19200300.100.1.41
organizationalStatus A 0.9.2342.19200300.100.1.45
pager A 0.9.2342.19200300.100.1.42
pagerTelephoneNumber A* 0.9.2342.19200300.100.1.42
personalTitle A 0.9.2342.19200300.100.1.40
rFC822LocalPart O 0.9.2342.19200300.100.4.14
rfc822Mailbox A* 0.9.2342.19200300.100.1.3
room O 0.9.2342.19200300.100.4.7
roomNumber A 0.9.2342.19200300.100.1.6
secretary A 0.9.2342.19200300.100.1.21
simpleSecurityObject O 0.9.2342.19200300.100.4.19
singleLevelQuality A 0.9.2342.19200300.100.1.50
uniqueIdentifier A 0.9.2342.19200300.100.1.44
userClass A 0.9.2342.19200300.100.1.8
where Type A is Attribute, Type O is ObjectClass, and *
indicates that the registration is historic in nature.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. Acknowledgements</span>
This document is based on <a href="./rfc1274">RFC 1274</a>, by Paul Barker and Steve Kille,
as well as on <a href="./rfc2247">RFC 2247</a>, by Steve Kill, Mark Wahl, Al Grimstad, Rick
Huber, and Sri Satulari.
<span class="h2"><a class="selflink" id="section-7" href="#section-7">7</a>. References</span>
<span class="h3"><a class="selflink" id="section-7.1" href="#section-7.1">7.1</a>. Normative References</span>
[<a id="ref-RFC1034">RFC1034</a>] Mockapetris, P., "Domain names - concepts and
facilities", STD 13, <a href="./rfc1034">RFC 1034</a>, November 1987.
[<a id="ref-RFC1123">RFC1123</a>] Braden, R., "Requirements for Internet Hosts -
Application and Support", STD 3, <a href="./rfc1123">RFC 1123</a>, October
1989.
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.
<span class="grey">Zeilenga Standards Track [Page 20]</span><span id="page-21" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
[<a id="ref-RFC2181">RFC2181</a>] Elz, R. and R. Bush, "Clarifications to the DNS
Specification", <a href="./rfc2181">RFC 2181</a>, July 1997.
[<a id="ref-RFC2247">RFC2247</a>] Kille, S., Wahl, M., Grimstad, A., Huber, R., and S.
Sataluri, "Using Domains in LDAP/X.500 Distinguished
Names", <a href="./rfc2247">RFC 2247</a>, January 1998.
[<a id="ref-RFC2821">RFC2821</a>] Klensin, J., Ed., "Simple Mail Transfer Protocol", <a href="./rfc2821">RFC</a>
<a href="./rfc2821">2821</a>, April 2001.
[<a id="ref-RFC2822">RFC2822</a>] Resnick, P., "Internet Message Format", <a href="./rfc2822">RFC 2822</a>, April
2001.
[<a id="ref-RFC3490">RFC3490</a>] Faltstrom, P., Hoffman, P., and A. Costello,
"Internationalizing Domain Names in Applications
(IDNA)", <a href="./rfc3490">RFC 3490</a>, March 2003.
[<a id="ref-RFC4510">RFC4510</a>] Zeilenga, K., Ed., "Lightweight Directory Access
Protocol (LDAP): Technical Specification Road Map", <a href="./rfc4510">RFC</a>
<a href="./rfc4510">4510</a>, June 2006.
[<a id="ref-RFC4512">RFC4512</a>] Zeilenga, K., "Lightweight Directory Access Protocol
(LDAP): Directory Information Models", <a href="./rfc4512">RFC 4512</a>, June
2006.
[<a id="ref-RFC4513">RFC4513</a>] Harrison, R., "Lightweight Directory Access Protocol
(LDAP): Authentication Methods and Security
Mechanisms", <a href="./rfc4513">RFC 4513</a>, June 2006.
[<a id="ref-RFC4517">RFC4517</a>] Legg, S., Ed., "Lightweight Directory Access Protocol
(LDAP): Syntaxes and Matching Rules", RC 4517, June
2006.
[<a id="ref-RFC4519">RFC4519</a>] Sciberras, A., Ed., "Lightweight Directory Access
Protocol (LDAP): Schema for User Applications", <a href="./rfc4519">RFC</a>
<a href="./rfc4519">4519</a>, June 2006.
[<a id="ref-X.501">X.501</a>] International Telecommunication Union -
Telecommunication Standardization Sector, "The
Directory -- Models," X.501(1993) (also ISO/IEC 9594-
2:1994).
<span class="h3"><a class="selflink" id="section-7.2" href="#section-7.2">7.2</a>. Informative References</span>
[<a id="ref-COSINEpilot">COSINEpilot</a>] Goodman, D., "PARADISE" section of the March 1991
INTERNET MONTHLY REPORTS (p. 28-29),
<a href="http://www.iana.org/periodic-reports/imr-mar91.txt">http://www.iana.org/periodic-reports/imr-mar91.txt</a>
<span class="grey">Zeilenga Standards Track [Page 21]</span><span id="page-22" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
[<a id="ref-ISO3166">ISO3166</a>] International Organization for Standardization, "Codes
for the representation of names of countries", ISO
3166.
[<a id="ref-RFC1274">RFC1274</a>] Barker, P. and S. Kille, "The COSINE and Internet X.500
Schema", <a href="./rfc1274">RFC 1274</a>, November 1991.
[<a id="ref-RFC1279">RFC1279</a>] Hardcastle-Kille, S., "X.500 and Domains", <a href="./rfc1279">RFC 1279</a>,
November 1991.
[<a id="ref-RFC1487">RFC1487</a>] Yeong, W., Howes, T., and S. Kille, "X.500 Lightweight
Directory Access Protocol", <a href="./rfc1487">RFC 1487</a>, July 1993.
[<a id="ref-RFC2251">RFC2251</a>] Wahl, M., Howes, T., and S. Kille, "Lightweight
Directory Access Protocol (v3)", <a href="./rfc2251">RFC 2251</a>, December
1997.
[<a id="ref-RFC2798">RFC2798</a>] Smith, M., "Definition of the inetOrgPerson LDAP Object
Class", <a href="./rfc2798">RFC 2798</a>, April 2000.
[<a id="ref-RFC3494">RFC3494</a>] Zeilenga, K., "Lightweight Directory Access Protocol
version 2 (LDAPv2) to Historic Status", <a href="./rfc3494">RFC 3494</a>, March
2003.
[<a id="ref-RFC4520">RFC4520</a>] Zeilenga, K., "Internet Assigned Numbers Authority
(IANA) Considerations for the Lightweight Directory
Access Protocol (LDAP)", <a href="https://www.rfc-editor.org/bcp/bcp64">BCP 64</a>, <a href="./rfc4520">RFC 4520</a>.
<span class="grey">Zeilenga Standards Track [Page 22]</span><span id="page-23" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
<span class="h2"><a class="selflink" id="appendix-A" href="#appendix-A">Appendix A</a>. Changes since <a href="./rfc1274">RFC 1274</a></span>
This document represents a substantial rewrite of <a href="./rfc1274">RFC 1274</a>. The
following sections summarize the substantive changes.
<span class="h3"><a class="selflink" id="appendix-A.1" href="#appendix-A.1">A.1</a>. LDAP Short Names</span>
A number of COSINE attribute types have short names in LDAP.
X.500 Name LDAP Short Name
------------- ---------------
domainComponent dc
favoriteDrink drink
friendCountryName co
homeTelephoneNumber homePhone
mobileTelephoneNumber mobile
pagerTelephoneNumber pager
rfc822Mailbox mail
userid uid
While the LDAP short names are generally used in LDAP, some
implementations may (for legacy reasons [<a href="./rfc3494" title=""Lightweight Directory Access Protocol version 2 (LDAPv2) to Historic Status"">RFC3494</a>]) recognize the
attribute type by its X.500 name. Hence, the X.500 names have been
reserved solely for this purpose.
Note: 'uid' and 'dc' are described in [<a href="./rfc4519" title=""Lightweight Directory Access Protocol (LDAP): Schema for User Applications"">RFC4519</a>].
<span class="h3"><a class="selflink" id="appendix-A.2" href="#appendix-A.2">A.2</a>. pilotObject</span>
The 'pilotObject' object class was not brought forward as its
function is largely replaced by operational attributes introduced in
X.500(93) [<a href="#ref-X.501" title=""The Directory -- Models,"">X.501</a>] and version 3 of LDAP [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]. For instance, the
function of the 'lastModifiedBy' and 'lastModifiedTime' attribute
types is now served by the 'creatorsName', 'createTimestamp',
'modifiersName', and 'modifyTimestamp' operational attributes
[<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>].
<span class="h3"><a class="selflink" id="appendix-A.3" href="#appendix-A.3">A.3</a>. pilotPerson</span>
The 'pilotPerson' object class was not brought forward as its
function is largely replaced by the 'organizationalPerson' [<a href="./rfc4512" title=""Lightweight Directory Access Protocol (LDAP): Directory Information Models"">RFC4512</a>]
object class and its subclasses, such as 'inetOrgPerson' [<a href="./rfc2798" title=""Definition of the inetOrgPerson LDAP Object Class"">RFC2798</a>].
Most of the related attribute types (e.g., 'mail', 'manager') were
brought forward as they are used in other object classes.
<span class="grey">Zeilenga Standards Track [Page 23]</span><span id="page-24" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
<span class="h3"><a class="selflink" id="appendix-A.4" href="#appendix-A.4">A.4</a>. dNSDomain</span>
The 'dNSDomain' object class and related attribute types were not
brought forward as its use is primarily experimental [<a href="./rfc1279" title=""X.500 and Domains"">RFC1279</a>].
<span class="h3"><a class="selflink" id="appendix-A.5" href="#appendix-A.5">A.5</a>. pilotDSA and qualityLabelledData</span>
The 'pilotDSA' and 'qualityLabelledData' object classes, as well as
related attribute types, were not brought forward as its use is
primarily experimental [QoS].
<span class="h3"><a class="selflink" id="appendix-A.6" href="#appendix-A.6">A.6</a>. Attribute Syntaxes</span>
<a href="./rfc1274">RFC 1274</a> defined and used caseIgnoreIA5StringSyntax attribute syntax.
This has been replaced with the IA5String syntax and appropriate
matching rules in 'mail' and 'associatedDomain'.
<a href="./rfc1274">RFC 1274</a> restricted 'mail' to have non-zero length values. This
restriction is not reflected in the IA5String syntax used in the
definitions provided in this specification. However, as values are
to conform to the <Mailbox> production, the 'mail' should not contain
zero-length values. Unfortunately, the directory service will not
enforce this restriction.
<span class="h2"><a class="selflink" id="appendix-B" href="#appendix-B">Appendix B</a>. Changes since <a href="./rfc2247">RFC 2247</a></span>
The 'domainNameForm' name form was not brought forward as
specification of name forms used in LDAP is left to a future
specification.
Editor's Address
Kurt D. Zeilenga
OpenLDAP Foundation
EMail: [email protected]
<span class="grey">Zeilenga Standards Track [Page 24]</span><span id="page-25" ></span>
<span class="grey"><a href="./rfc4524">RFC 4524</a> COSINE LDAP/X.500 Schema June 2006</span>
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a>, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and <a href="https://www.rfc-editor.org/bcp/bcp79">BCP 79</a>.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
<a href="http://www.ietf.org/ipr">http://www.ietf.org/ipr</a>.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
[email protected].
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).
Zeilenga Standards Track [Page 25]
Annotations
Select text to annotate