RFC 2293

Representing Tables and Subtrees in the X.500 Directory

📅 published March 1998, from ietf

Representing Tables and Subtrees in the X.500 Directory ✨

Okay bestie, here's the vibe check on this one 💅

RFC: 2293
Network Working Group
Author: Steve (S. Kille), Isode Ltd. 🎀
Category: Standards Track 🔥
Date: March 1998 🌸
Obsoletes: RFC 1837 💀
Updates: none listed

Status of this Memo 📜

Okay so this one is an Internet standards track protocol for the whole Internet community, and it's basically asking everyone to talk about it and suggest improvements 🫶 If you want to know where this protocol stands in standardization, check the current edition of the "Internet Official Protocol Standards" (STD 1) 👑 And yes, distribution of this memo is totally unlimited 🦋

Copyright Notice ©️

Abstract ✨

This doc is all about two kinds of information mapping in the OSI Directory [1] 🧚 The first is mapping from a key to a value (or a set of values), kind of like a table lookup. The second is mapping from a distinguished name to an associated value (or values), where the owner of the entry doesn't define those values. The way they do this is with a directory subtree 🌈

These techniques were built to support MHS use of Directory [2], but they're specified on their own because they're useful way beyond that 💖

1. Representing Flat Tables 🍓

Before we get into specifics, let's look at a general-purpose way to represent tables in the directory 💅 The schema is in Figure 1. Basically, a table is an unordered set of key-to-(single or multiple)-value mappings, where the key can't be represented as a global name. There are four reasons this happens 😭

The object doesn't have a natural global name.
The object can only be named effectively as a key in a binding. In this case, the table gives the object a natural global name.
The object has a global name, and the table is used to attach parameters to it, usually because they can't go in the object's global entry. Reasons they might not go there include:
- The object doesn't have a directory entry
- There's no authority to put the parameters in the global entry
- The parameters aren't global. They only make sense in the context of the table.
It's desirable to group information together as a performance optimization, so the block of information can be widely replicated 🚀

A table is represented as a single-level subtree. The root is an entry of object class Table, named with a common name that describes the table. The table lives somewhere that makes sense for what it does. If a table is private to an MTA, it goes below the MTA's entry. If it's shared by MTAs in an organization, it goes under the organization 🏢

The generic table entry only holds a description. Every instance gets subclassed, and the subclass defines the naming attribute. Two subclasses are defined 💜

table OBJECT-CLASS ::= {
    SUBCLASS OF {top}
    MUST CONTAIN {commonName}
    MAY CONTAIN {manager}
    ID oc-table}


tableEntry OBJECT-CLASS ::= {
    SUBCLASS OF {top}
    MAY CONTAIN {description}                                       10
    ID oc-table-entry}

textTableEntry OBJECT-CLASS ::= {
    SUBCLASS OF {tableEntry}
    MUST CONTAIN {textTableKey}
    MAY CONTAIN {textTableValue}
    ID oc-text-table-entry}

textTableKey ATTRIBUTE ::= {
    SUBTYPE OF name                                                 20
    WITH SYNTAX DirectoryString {ub-name}
    ID at-text-table-key}

textTableValue ATTRIBUTE ::= {
    SUBTYPE OF name
    WITH SYNTAX  DirectoryString {ub-description}
    ID at-text-table-value}

distinguishedNameTableEntry OBJECT-CLASS ::= {
    SUBCLASS OF {tableEntry}                                        30
    MUST CONTAIN {distinguishedNameTableKey}
    ID oc-distinguished-name-table-entry}

distinguishedNameTableKey ATTRIBUTE ::= {
    SUBTYPE OF distinguishedName
    ID at-distinguished-name-table-key}

                     Figure 1:  Representing Tables

So here are the two subclasses 🎀

TextEntry, which defines table entries with text keys. These can have single or multiple values of any type. There's an attribute for a text value, which supports the super common text-key-to-text-value mapping. More values can be defined too.
DistinguishedNameEntry. This is for attaching information to globally defined objects. Use this when the table has only a few objects, or they're very sparsely spread across the DIT. If there are lots of objects, or they're tightly clustered in the DIT, the subtree approach from Section 2 is the better move. No value attributes are defined for this type of entry. An application that uses it does its own subtyping to define whatever values it needs ✨

Let's look at an example, because it's way easier to get with examples 🧠 Say we have this MTA:

CN=Bells, OU=Computer Science,
O=University College London, C=GB

Now suppose the MTA needs a table mapping private keys to fully qualified domain names. (This example is made up, fyi.) The table might be named:

CN=domain-nicknames,
CN=Bells, OU=Computer Science,
O=University College London, C=GB

To represent a mapping in this table from "euclid" to "bloomsbury.ac.uk", the entry:

TextTableKey=euclid, CN=domain-nicknames,
CN=Bells, OU=Computer Science,
O=University College London, C=GB

will contain the attribute:

TextTableValue=bloomsbury.ac.uk

Here's a second example, this time with DistinguishedNameEntry. Same MTA:

CN=Bells, OU=Computer Science,
O=University College London, C=GB

This time the MTA needs a table mapping from MTA Name to the bilateral agreement info for that MTA. The table might be named:

CN=MTA Bilateral Agreements,
CN=Bells, OU=Computer Science,
O=University College London, C=GB

To represent info about the MTA with the Distinguished Name:

CN=Q3T21, ADMD=Gold 400, C=GB

there would be an entry in this table whose Relative Distinguished Name is the Distinguished Name of the MTA being referred to. The MTA bilateral info would be an attribute in that entry. Using a non-standard notation, the Distinguished Name of the table entry is:

DistinguishedNameTableKey=<CN=Q3T21, ADMD=Gold 400, C=GB>,
CN=MTA Bilateral Agreements,
CN=Bells, OU=Computer Science,
O=University College London, C=GB

2. Representing Subtrees 🌳

A subtree is kind of like a table, except the keys are built as a distinguished name hierarchy relative to where the subtree sits in the DIT. The subtree basically starts its own private "root", and the distinguished names are relative to that root 🫧 This is usually used to attach local info to global objects. The schema is in Figure 2. Functionally, it's the same as a table with distinguished name keys. Tables are best when the tree is very sparse, and subtrees are better for more populated trees 💖

The subtree object class defines the root of a subtree in the same way the table does. Info inside the subtree is generally defined the same way as it would be for the global object, so

subtree OBJECT-CLASS ::= {
    SUBCLASS OF {top}
    MUST CONTAIN {commonName}
    MAY CONTAIN {manager}
    ID oc-subtree}

                     Figure 2:  Representing Subtrees

no specific object classes for subtree entries are needed 🙌

Here's an example with University College London 🎓

O=University College London, C=GB

Say UCL needs a private subtree with interesting info about directory objects. The table might be named:

CN=private subtree,
O=University College London, C=GB

UCL-specific info on Inria might be stored in the entry:

O=Inria, C=FR,
CN=private subtree,
O=University College London, C=GB

Practical examples of this mapping are given in [2] 📚

3. Acknowledgments 🫶

Acknowledgments for work on this document are given in [2].

References 📖

[1] The Directory --- overview of concepts, models and services, 1993. CCITT X.500 Series Recommendations.

[2] Kille, S.E., "X.400-MHS use of the X.500 directory to support X.400-MHS routing," RFC 1801, June 1995.

4. Security Considerations 💀

Security considerations are not discussed in this memo. (Yes, that's the whole section 😭 Don't skip it when you're implementing, bestie.)

5. Author's Address 📮

Steve Kille
Isode Ltd
The Dome
The Square
Richmond
TW9 1DT
England

Phone:  +44-181-332-9091
EMail:  S.Kille@ISODE.COM

A. Object Identifier Assignment 🧚

Here's where all the OIDs live 🌈

mhs-ds OBJECT IDENTIFIER ::= {iso(1) org(3) dod(6) internet(1)
          private(4) enterprises(1) isode-consortium (453) mhs-ds (7)}

tables OBJECT IDENTIFIER ::= {mhs-ds 1}

oc OBJECT IDENTIFIER ::= {tables 1}
at OBJECT IDENTIFIER ::= {tables 2}

oc-subtree OBJECT IDENTIFIER ::= {oc 1}
oc-table OBJECT IDENTIFIER ::= {oc 2}                               10
oc-table-entry OBJECT IDENTIFIER ::= {oc 3}
oc-text-table-entry OBJECT IDENTIFIER ::= {oc 4}
oc-distinguished-name-table-entry  OBJECT IDENTIFIER ::= {oc 5}

at-text-table-key OBJECT IDENTIFIER ::= {at 1}
at-text-table-value OBJECT IDENTIFIER ::= {at 2}
at-distinguished-name-table-key OBJECT IDENTIFIER ::= {at 3}

                Figure 3:  Object Identifier Assignment

Full Copyright Statement ⚖️

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. ✨

📦 where this page comes from

ietf: rfc2293 1998-03
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms