RFC 2256
A Summary of the X.500(96) User Schema for use with LDAPv3
RFC 2256 📜🎀 (Part 1 of 3)
Title: A Summary of the X.500(96) User Schema for use with LDAPv3 💖 Author: M. Wahl, Critical Angle Inc. 🧑💻 Stream: Network Working Group Category: Standards Track 🌟 Date: December 1997 🗓️ Obsoletes / Updates: This title block doesn't list anything it obsoletes or updates 🤷♀️
1. Status of this Memo ✨
okay so this one is an Internet standards track protocol for the Internet community 🌐, and it's literally asking everyone to chime in with discussion and suggestions for improvements 💬. For the standardization state and status of this protocol, go check the current edition of the "Internet Official Protocol Standards" (STD 1) 📋. And distribution of this memo is unlimited, so share it with everyone bestie 🫶.
Copyright Notice
Copyright (C) The Internet Society (1997). All Rights Reserved. ©️🌸
IESG Note
ok this part is SO important, read it twice 🙈⚠️. This document describes a directory access protocol that gives you both read and update access 📖✏️. Update access needs secure authentication, but this document does not mandate implementation of any satisfactory authentication mechanisms 😬.
Even with that gap, the IESG approved this as a Proposed Standard, per RFC 2026, section 4.4.1 🏛️. They gave three reasons, iykyk:
- 🦋 to encourage implementation and interoperability testing of these protocols (with or without update access) before they are deployed, and
- 🌷 to encourage deployment and use of these protocols in read-only applications. (e.g. applications where LDAPv3 is used as a query language for directories which are updated by some secure mechanism other than LDAP), and
- 🧚 to avoid delaying the advancement and deployment of other Internet standards-track protocols which require the ability to query, but not update, LDAPv3 directory servers.
🚨 Readers are hereby warned that until mandatory authentication mechanisms are standardized, clients and servers written according to this specification which make use of update functionality are UNLIKELY TO INTEROPERATE, or MAY INTEROPERATE ONLY IF AUTHENTICATION IS REDUCED TO AN UNACCEPTABLY WEAK LEVEL. 💀 That is not it, that is a whole vibe check on update mode.
Implementors are hereby discouraged from deploying LDAPv3 clients or servers which implement the update functionality, until a Proposed Standard for mandatory authentication in LDAPv3 has been approved and published as an RFC 🙅♀️🔐. Not me being the one to ignore this 😤.
2. Abstract 📝
So this document gives you an overview of the attribute types and object classes that the ISO and ITU-T committees defined in the X.500 documents 🧾, especially the ones meant for directory clients 👩💻. It's the most widely used schema for LDAP/X.500 directories 👑, and tons of other schema definitions for white pages objects are built on top of it 🏗️. It does not cover attributes used for administering X.500 directory servers, and it also leaves out attributes defined by other ISO/ITU-T documents 🙅♀️.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [6] 🔑. Those words are the official BCP 14 vocab, so read them carefully, bestie 🎀.
3. General Issues 🧩
This document references syntaxes given in section 6 of this document and section 6 of [1] 🔗. Matching rules are listed in section 8 of this document and section 8 of [1] 🎯.
The attribute type and object class definitions are written using the BNF form of AttributeTypeDescription and ObjectClassDescription given in [1] 📐. Lines have been folded for readability, so don't freak out if a line looks chopped up 🙈.
4. Source 📚
The schema definitions in this document are based on those found in X.500 [2],[3],[4],[5], and updates to these documents 🌈. Here's the breakdown of which section comes from which source, no cap 💅:
Sections Source
============ ============
5.1 - 5.2 X.501(93)
5.3 - 5.36 X.520(88)
5.37 - 5.41 X.509(93)
5.42 - 5.52 X.520(93)
5.53 - 5.54 X.509(96)
5.55 X.520(96)
6.1 RFC 1274
6.2 (new syntax)
6.3 - 6.6 RFC 1274
7.1 - 7.2 X.501(93)
7.3 - 7.18 X.521(93)
7.19 - 7.21 X.509(96)
7.22 X.521(96)Some attribute names are different from those found in X.520(93) 🔁, so watch out for that 👀.
Three new attributes, supportedAlgorithms, deltaRevocationList and dmdName, plus the objectClass dmd, are defined in the X.500(96) documents 🆕✨.
5. Attribute Types 🎀
An LDAP server implementation SHOULD recognize the attribute types described in this section 💯. This is the core stuff, so pay attention 📌.
5.1. objectClass 🏷️
The values of the objectClass attribute describe the kind of object which an entry represents 🧸. The objectClass attribute is present in every entry, with at least two values 🙌. One of those values is either "top" or "alias" 🪞.
( 2.5.4.0 NAME 'objectClass' EQUALITY objectIdentifierMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )5.2. aliasedObjectName 🔗
The aliasedObjectName attribute is used by the directory service if the entry containing this attribute is an alias 🪄.
( 2.5.4.1 NAME 'aliasedObjectName' EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )5.3. knowledgeInformation 🕰️
This attribute is no longer used 🙃.
( 2.5.4.2 NAME 'knowledgeInformation' EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )5.4. cn 🫧
This is the X.500 commonName attribute, which contains a name of an object 🏷️. If the object corresponds to a person, it's typically the person's full name 🧑.
( 2.5.4.3 NAME 'cn' SUP name )5.5. sn 👩👧
This is the X.500 surname attribute, which contains the family name of a person 💕.
( 2.5.4.4 NAME 'sn' SUP name )5.6. serialNumber 🔢
This attribute contains the serial number of a device 🖨️.
( 2.5.4.5 NAME 'serialNumber' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{64} )5.7. c 🌍
This attribute contains a two-letter ISO 3166 country code (countryName) 🗺️.
( 2.5.4.6 NAME 'c' SUP name SINGLE-VALUE )5.8. l 🏙️
This attribute contains the name of a locality, such as a city, county or other geographic region (localityName) 🌆.
( 2.5.4.7 NAME 'l' SUP name )5.9. st 🌄
This attribute contains the full name of a state or province (stateOrProvinceName) 🗾.
( 2.5.4.8 NAME 'st' SUP name )5.10. street 🛣️
This attribute contains the physical address of the object the entry corresponds to, such as an address for package delivery (streetAddress) 📦.
( 2.5.4.9 NAME 'street' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )5.11. o 🏢
This attribute contains the name of an organization (organizationName) 💼.
( 2.5.4.10 NAME 'o' SUP name )5.12. ou 🧑🤝🧑
This attribute contains the name of an organizational unit (organizationalUnitName) 🗂️.
( 2.5.4.11 NAME 'ou' SUP name )5.13. title 👑
This attribute contains the title, such as "Vice President", of a person in their organizational context 💼. The "personalTitle" attribute would be used for a person's title independent of their job function 💁♀️.
( 2.5.4.12 NAME 'title' SUP name )5.14. description 📝
This attribute contains a human-readable description of the object 💬.
( 2.5.4.13 NAME 'description' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} )5.15. searchGuide 🧭
This attribute is for use by X.500 clients in constructing search filters 🔍. It is obsoleted by enhancedSearchGuide, described below in 5.48 🙅♀️.
( 2.5.4.14 NAME 'searchGuide'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.25 )5.16. businessCategory 💼
This attribute describes the kind of business performed by an organization 🏪.
( 2.5.4.15 NAME 'businessCategory' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )5.17. postalAddress 📮
( 2.5.4.16 NAME 'postalAddress' EQUALITY caseIgnoreListMatch
SUBSTR caseIgnoreListSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )5.18. postalCode 📫
( 2.5.4.17 NAME 'postalCode' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40} )5.19. postOfficeBox 📭
( 2.5.4.18 NAME 'postOfficeBox' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40} )5.20. physicalDeliveryOfficeName 🏬
( 2.5.4.19 NAME 'physicalDeliveryOfficeName' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )5.21. telephoneNumber 📞
( 2.5.4.20 NAME 'telephoneNumber' EQUALITY telephoneNumberMatch
SUBSTR telephoneNumberSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.50{32} )5.22. telexNumber 📠
( 2.5.4.21 NAME 'telexNumber'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.52 )5.23. teletexTerminalIdentifier 🖥️
( 2.5.4.22 NAME 'teletexTerminalIdentifier'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.51 )5.24. facsimileTelephoneNumber 📠
( 2.5.4.23 NAME 'facsimileTelephoneNumber'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.22 )5.25. x121Address 🔢
( 2.5.4.24 NAME 'x121Address' EQUALITY numericStringMatch
SUBSTR numericStringSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{15} )5.26. internationaliSDNNumber 🔢
( 2.5.4.25 NAME 'internationaliSDNNumber' EQUALITY numericStringMatch
SUBSTR numericStringSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.36{16} )5.27. registeredAddress ✉️
This attribute holds a postal address suitable for reception of telegrams or expedited documents, where it is necessary to have the recipient accept delivery 🚚.
( 2.5.4.26 NAME 'registeredAddress' SUP postalAddress
SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )5.28. destinationIndicator 📡
This attribute is used for the telegram service 📨.
( 2.5.4.27 NAME 'destinationIndicator' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44{128} )5.29. preferredDeliveryMethod 🛎️
( 2.5.4.28 NAME 'preferredDeliveryMethod'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.14
SINGLE-VALUE )5.30. presentationAddress 🌐
This attribute contains an OSI presentation address 🛰️.
( 2.5.4.29 NAME 'presentationAddress'
EQUALITY presentationAddressMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.43
SINGLE-VALUE )5.31. supportedApplicationContext 🧩
This attribute contains the identifiers of OSI application contexts 🆔.
( 2.5.4.30 NAME 'supportedApplicationContext'
EQUALITY objectIdentifierMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )5.32. member 🫂
( 2.5.4.31 NAME 'member' SUP distinguishedName )5.33. owner 🔑
( 2.5.4.32 NAME 'owner' SUP distinguishedName )5.34. roleOccupant 🎭
( 2.5.4.33 NAME 'roleOccupant' SUP distinguishedName )5.35. seeAlso 👀
( 2.5.4.34 NAME 'seeAlso' SUP distinguishedName )5.36. userPassword 🔐
( 2.5.4.35 NAME 'userPassword' EQUALITY octetStringMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} )🚨 Passwords are stored using an Octet String syntax and are not encrypted 😱. Transfer of cleartext passwords are strongly discouraged where the underlying transport service cannot guarantee confidentiality and may result in disclosure of the password to unauthorized parties 💀. Keep your passwords locked down, bestie 🔒.
5.37. userCertificate 📜
This attribute is to be stored and requested in the binary form, as 'userCertificate;binary' 🧾.
( 2.5.4.36 NAME 'userCertificate'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )5.38. cACertificate 🏅
This attribute is to be stored and requested in the binary form, as 'cACertificate;binary' 💾.
( 2.5.4.37 NAME 'cACertificate'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )5.39. authorityRevocationList 🎀
Okay so this one has to be stored and requested in binary form, bestie. You write it as authorityRevocationList;binary and that's the whole vibe 💅
( 2.5.4.38 NAME 'authorityRevocationList'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )5.40. certificateRevocationList 📜
Same energy here! This one also has to be stored and requested in binary form, as certificateRevocationList;binary. Binary all the way 🦋
( 2.5.4.39 NAME 'certificateRevocationList'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )5.41. crossCertificatePair 💖
Also binary, obviously. You store and request it as crossCertificatePair;binary 🫶
( 2.5.4.40 NAME 'crossCertificatePair'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.10 )5.42. name 👑
Okay this one is the supertype, the OG attribute. String attribute types that are typically used for naming can be built from it 🧚 It's super unlikely that you'll actually find a value of name itself sitting in an entry, so don't expect to see it just floating around ✨
LDAP server implementations that don't support attribute subtyping don't have to recognize this attribute in requests, which is totally fine 🌸
Client implementations MUST NOT assume that LDAP servers are capable of performing attribute subtyping. Don't assume your server is a subtyping queen unless you've checked 🙈
( 2.5.4.41 NAME 'name' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )5.43. givenName 🌈
givenName holds the part of a person's name that's neither their surname nor their middle name. Your first name, basically 🍓
( 2.5.4.42 NAME 'givenName' SUP name )5.44. initials ✨
initials contains the initials of some or all of a person's names, but not the surname(s). So it's the little letters, not the whole family crest 💅
( 2.5.4.43 NAME 'initials' SUP name )5.45. generationQualifier 🎀
This is the suffix bit of the name, the stuff like "IIIrd". Very royal energy 👑
( 2.5.4.44 NAME 'generationQualifier' SUP name )5.46. x500UniqueIdentifier 🦋
x500UniqueIdentifier is how you tell objects apart when a distinguished name has been reused. It's a totally different attribute type from both "uid" and "uniqueIdentifier", so don't mix them up, bestie 🙃
( 2.5.4.45 NAME 'x500UniqueIdentifier' EQUALITY bitStringMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )5.47. dnQualifier 💜
dnQualifier adds disambiguating info to the relative distinguished name of an entry. It's for when you're merging data from multiple sources and want to stop entries that would otherwise have the same name from clashing 🫶 It's recommended that the value of dnQualifier be the same for all entries from a particular source, which is a super smart move ✨
( 2.5.4.46 NAME 'dnQualifier' EQUALITY caseIgnoreMatch
ORDERING caseIgnoreOrderingMatch SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 )5.48. enhancedSearchGuide 🔥
This one is for X.500 clients to use when they're building search filters. Client-side search wizardry 🧙
( 2.5.4.47 NAME 'enhancedSearchGuide'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.21 )5.49. protocolInformation 🌸
protocolInformation gets used alongside presentationAddress to give extra info to the OSI network service. It's the plus-one at the party 🎀
( 2.5.4.48 NAME 'protocolInformation'
EQUALITY protocolInformationMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.42 )5.50. distinguishedName 💅
This one isn't used as the name of the object itself. It's a base type that attributes with DN syntax inherit from, so it's the parent figure ✨
It's unlikely that values of this type itself will occur in an entry. LDAP server implementations that don't support attribute subtyping don't need to recognize this attribute in requests, and that's valid 🙈
Client implementations MUST NOT assume that LDAP servers are capable of performing attribute subtyping. Same rule, bestie, don't just assume 💀
( 2.5.4.49 NAME 'distinguishedName' EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )5.51. uniqueMember 🦋
Quick and clean. uniqueMember has its own equality matching rule and syntax, and that's the whole story 💖
( 2.5.4.50 NAME 'uniqueMember' EQUALITY uniqueMemberMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )5.52. houseIdentifier 🏡
houseIdentifier is how you identify a building within a location. Address-core energy 🍓
( 2.5.4.51 NAME 'houseIdentifier' EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )5.53. supportedAlgorithms 🔐
Binary again, sorry not sorry. You store and request it as supportedAlgorithms;binary 🫶
( 2.5.4.52 NAME 'supportedAlgorithms'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 )5.54. deltaRevocationList ✨
Yep, binary, same as the other revocation lists. You write it as deltaRevocationList;binary 💅
( 2.5.4.53 NAME 'deltaRevocationList'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )5.55. dmdName 👑
dmdName specifies a directory management domain (DMD), which is the administrative authority that runs the directory server. The boss of the server, iykyk 🧚
( 2.5.4.54 NAME 'dmdName' SUP name )6. Syntaxes 🌈
Servers SHOULD recognize the syntaxes defined in this section. Each syntax starts with a sample value of the ldapSyntaxes attribute, which defines the OBJECT IDENTIFIER of that syntax. Syntax names aren't carried in protocol and aren't guaranteed to be unique, so don't rely on the names alone 🙈
6.1. Delivery Method 📮
( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )Values in this syntax are encoded according to the following BNF:
delivery-value = pdm / ( pdm whsp "$" whsp delivery-value )
pdm = "any" / "mhs" / "physical" / "telex" / "teletex" /
"g3fax" / "g4fax" / "ia5" / "videotex" / "telephone"Example:
telephone6.2. Enhanced Guide 🧭
( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' )Values in this syntax are encoded according to the following BNF:
EnhancedGuide = woid whsp "#" whsp criteria whsp "#" whsp subset
subset = "baseobject" / "oneLevel" / "wholeSubtree"The criteria production is defined in the Guide syntax below. This syntax got added after RFC 1778, so it's the newer kid on the block 🎀
Example:
person#(sn)#oneLevel6.3. Guide 🗺️
( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' )Values in this syntax are encoded according to the following BNF:
guide-value = [ object-class "#" ] criteria
object-class = woid
criteria = criteria-item / criteria-set / ( "!" criteria )
criteria-set = ( [ "(" ] criteria "&" criteria-set [ ")" ] ) /
( [ "(" ] criteria "|" criteria-set [ ")" ] )
criteria-item = [ "(" ] attributetype "$" match-type [ ")" ]
match-type = "EQ" / "SUBSTR" / "GE" / "LE" / "APPROX"This syntax should not be used for defining new attributes 🙅♀️
6.4. Octet String 🔢
( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )Values in this syntax are encoded as octet strings.
Example:
secret6.5. Teletex Terminal Identifier 📠
( 1.3.6.1.4.1.1466.115.121.1.51 DESC 'Teletex Terminal Identifier' )Values in this syntax are encoded according to the following BNF:
teletex-id = ttx-term 0*("$" ttx-param)
ttx-term = printablestring
ttx-param = ttx-key ":" ttx-value
ttx-key = "graphic" / "control" / "misc" / "page" / "private"
ttx-value = octetstringIn the above, the first printablestring is the encoding of the first portion of the teletex terminal identifier to be encoded, and the subsequent 0 or more octetstrings are subsequent portions of the teletex terminal identifier 💖
6.6. Telex Number ☎️
( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )Values in this syntax are encoded according to the following BNF:
telex-number = actual-number "$" country "$" answerback
actual-number = printablestring
country = printablestring
answerback = printablestringIn the above, actual-number is the syntactic representation of the number portion of the TELEX number being encoded, country is the TELEX country code, and answerback is the answerback code of a TELEX terminal 🧚
6.7. Supported Algorithm 🔐
( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' )No printable representation of values of the supportedAlgorithms attribute is defined in this document. Clients that want to store and retrieve this attribute MUST use "supportedAlgorithms;binary", where the value is transferred as a binary encoding 🫶
7. Object Classes 🦋
LDAP servers MUST recognize the object classes "top" and "subschema". LDAP servers SHOULD recognize all the other object classes listed here as values of the objectClass attribute 💅
7.1. top 👑
( 2.5.6.0 NAME 'top' ABSTRACT MUST objectClass )7.2. alias 🎭
( 2.5.6.1 NAME 'alias' SUP top STRUCTURAL MUST aliasedObjectName )7.3. country 🌍
( 2.5.6.2 NAME 'country' SUP top STRUCTURAL MUST c
MAY ( searchGuide $ description ) )7.4. locality 🏙️
( 2.5.6.3 NAME 'locality' SUP top STRUCTURAL
MAY ( street $ seeAlso $ searchGuide $ st $ l $ description ) )7.5. organization 🏢
( 2.5.6.4 NAME 'organization' SUP top STRUCTURAL MUST o
MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $
facsimileTelephoneNumber $
street $ postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ st $ l $ description ) )7.6. organizationalUnit 🧁
( 2.5.6.5 NAME 'organizationalUnit' SUP top STRUCTURAL MUST ou
MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $
facsimileTelephoneNumber $
street $ postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ st $ l $ description ) )7.7. person 🧍♀️
( 2.5.6.6 NAME 'person' SUP top STRUCTURAL MUST ( sn $ cn )
MAY ( userPassword $ telephoneNumber $ seeAlso $ description ) )7.8. organizationalPerson 💼
( 2.5.6.7 NAME 'organizationalPerson' SUP person STRUCTURAL
MAY ( title $ x121Address $ registeredAddress $
destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $
facsimileTelephoneNumber $
street $ postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ ou $ st $ l ) )7.9. organizationalRole 🎀
( 2.5.6.8 NAME 'organizationalRole' SUP top STRUCTURAL MUST cn
MAY ( x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $
facsimileTelephoneNumber $
seeAlso $ roleOccupant $ preferredDeliveryMethod $ street $
postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ ou $ st $ l $ description ) )7.10. groupOfNames 👯♀️
( 2.5.6.9 NAME 'groupOfNames' SUP top STRUCTURAL MUST ( member $ cn )
MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )7.11. residentialPerson 🏠
( 2.5.6.10 NAME 'residentialPerson' SUP person STRUCTURAL MUST l
MAY ( businessCategory $ x121Address $ registeredAddress $
destinationIndicator $ preferredDeliveryMethod $ telexNumber $
teletexTerminalIdentifier $ telephoneNumber $
internationaliSDNNumber $
facsimileTelephoneNumber $ preferredDeliveryMethod $ street $
postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ st $ l ) )7.12. applicationProcess ⚙️
( 2.5.6.11 NAME 'applicationProcess' SUP top STRUCTURAL MUST cn
MAY ( seeAlso $ ou $ l $ description ) )7.13. applicationEntity 💅
okay so this one is the object class for application entities, and it's giving structure 🦋
( 2.5.6.12 NAME 'applicationEntity' SUP top STRUCTURAL
MUST ( presentationAddress $ cn )
MAY ( supportedApplicationContext $ seeAlso $ ou $ o $ l $
description ) )7.14. dSA ✨
the dSA class is a little sibling of applicationEntity, bestie 🌸
( 2.5.6.13 NAME 'dSA' SUP applicationEntity STRUCTURAL
MAY knowledgeInformation )7.15. device 🎀
( 2.5.6.14 NAME 'device' SUP top STRUCTURAL MUST cn
MAY ( serialNumber $ seeAlso $ owner $ ou $ o $ l $ description ) )7.16. strongAuthenticationUser 🔐
this one is AUXILIARY, so it gets tacked onto other entries, and it MUST carry a userCertificate 🍓
( 2.5.6.15 NAME 'strongAuthenticationUser' SUP top AUXILIARY
MUST userCertificate )7.17. certificationAuthority 👑
another AUXILIARY class, with a few must-haves and one optional extra 🧚
( 2.5.6.16 NAME 'certificationAuthority' SUP top AUXILIARY
MUST ( authorityRevocationList $ certificateRevocationList $
cACertificate ) MAY crossCertificatePair )7.18. groupOfUniqueNames 🫶
( 2.5.6.17 NAME 'groupOfUniqueNames' SUP top STRUCTURAL
MUST ( uniqueMember $ cn )
MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )7.19. userSecurityInformation 🔥
( 2.5.6.18 NAME 'userSecurityInformation' SUP top AUXILIARY
MAY ( supportedAlgorithms ) )7.20. certificationAuthority-V2 💜
this is the V2 glow-up of certificationAuthority, and it's AUXILIARY with an optional deltaRevocationList 🦋
( 2.5.6.16.2 NAME 'certificationAuthority-V2' SUP
certificationAuthority
AUXILIARY MAY ( deltaRevocationList ) )7.21. cRLDistributionPoint 🌈
( 2.5.6.19 NAME 'cRLDistributionPoint' SUP top STRUCTURAL
MUST ( cn ) MAY ( certificateRevocationList $
authorityRevocationList $
deltaRevocationList ) )7.22. dmd ⭐
the dmd class is the biggest one here, with a whole lot of optional attributes 💅
( 2.5.6.20 NAME 'dmd' SUP top STRUCTURAL MUST ( dmdName )
MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $
facsimileTelephoneNumber $
street $ postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ st $ l $ description ) )8. Matching Rules ✨
okay so servers MAY implement additional matching rules, and that's the vibe 🧚
8.1. octetStringMatch 🦋
servers that implement the extensibleMatch filter SHOULD allow the matching rule in this section to be used in extensibleMatch. ngl, in general these servers SHOULD also allow matching rules to be used with every attribute type the server knows about, as long as the assertion syntax of the matching rule matches the value syntax of the attribute 💖
( 2.5.13.17 NAME 'octetStringMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )9. Security Considerations 🔐
this section is serious, bestie, so listen up 😭
Attributes of directory entries give descriptive info about the real-world objects they represent, and those objects can be people, organizations or devices. Most countries have privacy laws about publishing information about people, so please be careful 🫶
Transfer of cleartext passwords is strongly discouraged where the underlying transport service cannot guarantee confidentiality. It may disclose the password to unauthorized parties, and that is a huge no 💀
10. Acknowledgements 🌸
the definitions here were developed by committees for telecommunications and international standards, and no new attribute definitions were added. The syntax definitions are based on the ISODE "QUIPU" implementation of X.500 🎀
11. Bibliography 📚
- [1] Wahl, M., Coulbeck, A., Howes, T., and S. Kille, "Lightweight X.500 Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997.
- [2] The Directory: Models. ITU-T Recommendation X.501, 1996.
- [3] The Directory: Authentication Framework. ITU-T Recommendation X.509, 1996.
- [4] The Directory: Selected Attribute Types. ITU-T Recommendation X.520, 1996.
- [5] The Directory: Selected Object Classes. ITU-T Recommendation X.521, 1996.
- [6] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", RFC 2119, March 1997.
12. Author's Address 💌
Mark Wahl Critical Angle Inc. 4815 West Braker Lane #502-385 Austin, TX 78759 USA
Phone: +1 512 372 3160 EMail: M.Wahl@critical-angle.com
13. Full Copyright Statement ⚖️
Copyright (C) The Internet Society (1997). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 🌈
📦 where this page comes from
- ietf: rfc2256 1997-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms