RFC 2377

Naming Plan for Internet Directory-Enabled Applications 🎀

Okay bestie, so this is RFC 2377 📜✨. It's an Informational doc from September 1998, which means it's just sharing info with the Internet community 🦋. It is NOT an Internet standard, so nothing in here is an official spec 💅. It doesn't obsolete or update any other RFCs either 🌸.

The authors are A. Grimstad (AT&T), R. Huber (AT&T), S. Sataluri (Lucent Technologies), and M. Wahl (Critical Angle Inc.) 👑. The whole crew from the big telecom and software world came together to pitch a better naming plan 🫶.

Status of this Memo 💜

This memo gives info to the Internet community 🌈. It does not specify an Internet standard of any kind 💀. Distribution of this memo is unlimited 🍓.

Copyright Notice 🎀

Copyright (C) The Internet Society (1998). All Rights Reserved. 💖

Abstract ✨

Okay so here's the tea 🫖. Using the old-school X.500 way of naming things has kind of been a blocker 😭 for the authors when it comes to getting directory-enabled apps out there on the Internet 🌐. So they're proposing a brand new directory naming plan 🧚 that borrows the best parts of the most popular and successful Internet naming systems 💅. The idea is that this plan extends X.500 naming, which helps build an Internet White Pages Service (IWPS) 📖 and other directory apps, and fixes the problems people hit with the conventional X.500 approach 🔥.

1.0 Executive Summary 🌸

The authors say the conventional X.500 naming style has been a blocker 😩 for wide deployment of directory-enabled apps, at least from their experience ✨. The registration setup it needs is either basically missing or mostly ignored 🙈. The infrastructure that does exist is clunky to use and tends to give counterproductive results 💀. And the attributes used for naming confuse users and are inflexible for the people running directory servers 🫠.

This doc describes a naming plan for building an Internet directory infrastructure 🦋. It's meant to support directory-enabled apps and can be an alternative to, or an extension of, the conventional X.500 approach 💜.

The plan has two main features ✨. First, it builds the root and upper parts of the name hierarchy on top of the existing Domain Name System (DNS) names 🌈. This part uses ideas from the companion paper "Using Domains in LDAP Distinguished Names" [1] 📚. Second, it gives a bunch of options for assigning names to directory leaf objects, like person objects 🎀, including one option that lets you reuse existing Internet identifiers for people 🫶.

Here's the lowkey important bit 👑: just like the conventional X.500 naming style isn't a formal standard, using this naming plan is NOT required for directory-enabled apps on the Internet 🙅. Other approaches are fine too 🌷. That said, the authors believe that if this plan gets widely used, naming will stop being such a thorny issue for admins setting up an LDAP-based directory service 🥰. They also strongly encourage developers of directory-enabled products, especially LDAP clients and user interfaces, to assume this naming plan will be widely used and design their products around that 💅🔥.

Here's the summary of the proposal 📝.

The upper parts of the hierarchical directory tree should be built from the components of registered DNS names, using the domain component attribute "dc" 🌳. So the directory name for the organization with the domain name "acme.com" will be, for example:

dc=acme, dc=com

Organizations can add more directory structure ✨, for example to support access control lists or to partition their directory info, by using registered subdomains of DNS names 🧩. So the subdomain "corporate.acme.com" can be the basis for this directory name:

dc=corporate, dc=acme, dc=com

For naming directory leaf objects like persons, groups, server applications, and certification authorities in a hierarchical directory 🗂️, the authors propose using either the "uid" (user identifier) attribute or the "cn" (common name) attribute for the relative distinguished name. This plan doesn't constrain how these two attributes are used 🦋.

One approach, for example, is to use the uid attribute as the RDN when reusing an existing store of identifiers 🔁, and to use the cn attribute as the RDN when creating new identifiers specifically for the directory ✨. A handy existing identification scheme for person objects is the RFC822 mailbox identifier 📮. So an RDN for a person using this store of identifiers would look like:

uid=John.Smith@acme.com

For leaf objects that don't fit nicely with that scheme, the "cn" attribute is used, for example:

cn=Reading Room

So directory distinguished names end up with this structure, for example:

uid=John.Smith@acme.com, dc=acme, dc=com
uid=Mary.Jones@acme.com, dc=corporate, dc=acme, dc=com
uid=J.Smith@worldnet.att.net, dc=legal, dc=acme, dc=com
cn=Reading Room, dc=physics, dc=national-lab, dc=edu

2.0 The Problem 😤

The X.500 Directory model [2] can be used to build a world-wide distributed directory 🌍. The Internet X.500 Directory Pilot has been running for several years 🗓️ and has grown to about 1.5 million entries of varying quality 📈. But the pilot's growth rate is way lower than the Internet's growth rate during that same period 🥲.

A bunch of factors have held this pilot back 🙃. The common X.500 naming approach isn't the biggest problem 🤷‍♀️, but it has still limited the growth of an X.500-based Internet White Pages Service in several ways 🚧.

The usual way to build names in the X.500 community is written up as an informative (so not officially standardized) Annex B to X.521 📚. The relative distinguished name (RDN) of a user is a common name (cn) attribute 👤. It's supposed to be what people in that user's society would customarily understand as their name 💭. The distinguished name of a user is that cn combined with the name of some general object, like an organization or a geographic unit 🏢. There are two main problems with this style of naming ⚠️.

First, the common name attribute seems super user-friendly 🥺, but it can't really be used as an RDN in practice 💔. In any big set of users under the same Directory Information Tree (DIT) node, there will be collisions on common name 💥. The only ways around this are forcing uniqueness on common names, which they don't have, or adding another attribute to prevent collisions 🙄. That extra attribute usually has to be unique in a much bigger context to be practically useful 🌐. The end result is a RDN that is very long and unpopular with users 😩.

Second, and way more serious 🚨, X.500 hasn't been able to use many pre-existing names. Since X.500 naming models typically use organization names as part of the hierarchy [2, 3], organization names have to be registered 📝. And because organization names are often tied to trademarks and used in sales and promotions, registration can be a difficult and acrimonious process 😬.

The North American Directory Forum (NADF, now the North Atlantic Directory Forum but still the NADF) proposed avoiding the registration problem by using names that are already registered in the "civil naming infrastructure" [4][5] 🏛️. Directory distinguished names would be based on an organization's legal name, as recognized by some government agency (like a county clerk or a state secretary of state) or another registering entity such as ANSI 🧾.

This scheme has a big upside 🙌: it keeps directory service providers out of disputes over who gets to use a particular name 🥳. But it leads to rather obscure names 🫥. The legal name almost always takes a form that is less familiar and longer than what users normally associate with the organization 😵‍💫. For example, in the US, a large share of legal organization names end with ", Inc." as in "Acme, Inc." 💼. Also, in the US, the civil naming infrastructure doesn't operate nationally 🇺🇸, so the organization names it provides have to sit under state and regional DIT nodes 🗺️. That makes them hard to find when browsing the directory 🔍. NADF proposes a way to algorithmically derive multi-attribute RDNs, which would let entries or aliases go in more convenient spots in the DIT 🧭, but these derived names are cumbersome and unpopular 😖. For example, suppose Nadir is an organization registered in the New Jersey civil naming infrastructure under the name "Nadir Networks, Inc." 🏢. Its civil distinguished name (DN) would then be:

o="Nadir Networks, Inc.", st=New Jersey, c=US

while its derived name, which is unambiguous directly under c=US, would be:

o="Nadir Networks, Inc." + st=New Jersey, c=US

More generally 🌀, the requirement to register organizations in X.500 naming has led to national registration authorities whose job is mostly limited to assigning X.500 organization names 🗃️. Because X.500 has had very limited appeal 😴, interest in registering an organization with one of these national authorities has been minimal 🥱. And finally, multi-national organizations are frustrated by the lack of an international registration authority 🌏💔.

---

To be continued in Part 2 of 4 🎀💖 stay tuned bestie!

3.0 Requirements 📋✨

okay so bestie, a directory naming plan must give you a guide for building names (identifiers, labels) for directory objects. Those names have to be unambiguous, meaning each one points to exactly one directory object, within some context (a namespace). At the very least, that means inside one isolated directory server 🎀

A directory object is basically just a set of attribute values 💖 The link between a real-world thing and its directory object is made by directory-enabled apps, and in the general case it's one-to-many, so one real thing can have several directory objects 🦋

These are the extra naming characteristics this plan is trying to hit:

a) hierarchical 🌳

The Internet is HUGE, with a ton of objects and management domains, so it needs hierarchical names. Those names let you delegate stuff during name assignment and split up directory information across directory servers. It's giving organization 💅

b) friendly to loose coupling of directory servers 🫶

One goal of this plan is a naming pattern that makes it easier to loosely couple potentially autonomous directory servers into one bigger system 🌈

A name in a loosely-coupled system should uniquely identify one real-world object. Here's the tea though: that same real-world object can look different in different servers (say, independently managed ones). It might be a different directory object with different attributes but the same DN. The plan doesn't try to stop this, because it's a likely scenario. It doesn't try to make one single namespace for all directory objects either 🙈 (This issue gets a deeper dive in Section 5.1.)

c) readily usable by LDAP clients and servers 🧚

As of writing this, a ton of Lightweight Directory Access Protocol (LDAP) [6][7] implementations already exist or are about to drop. Names from this plan should be easy for those implementations, and the apps built on them, to use 💜

d) friendly to re-use of existing Internet name registries 🍓

Like we covered in Section 2 above, making brand-new global name registries has been a total nightmare 😭 So a core requirement here is letting you reuse existing Internet name registries, like DNS names and RFC822 mailbox identifiers, when you build directory names ✨

e) minimally user-friendly 🌸

Directory-enabled apps will (hopefully) keep users away from DNs, but users probably can't be totally shielded from them. So the naming plan should let you use familiar info when building names. At minimum, a user should be able to recognize the info encoded in their own DN. Names that are totally opaque to users just can't meet this 💀

4.0 Name Construction 🎀

The paper assumes you already know the terms distinguished name (DN) and relative distinguished name (RDN) [2][8][9]. Read up on those first, bestie 📚

We show how DNs can be built using three attribute types: domainComponent (dc), userID (uid) and commonName (cn). We'll go through each one in turn 🦋

4.1 Domain Component (dc) 🌐

The domain component attribute is defined and registered in RFC1274 [3][10]. It's used to build a DN from a domain name. The details of the construction algorithm are in "Using Domains in LDAP Distinguished Names" [1] 💖

Say an organization wants to deploy a directory following this naming plan. Let's use "Acme, Inc.", which has the registered domain name "acme.com", as the example. It would build the DN

dc=acme, dc=com

from its domain name, then use that DN as the root of its subtree of directory information 🌳

The DN itself can identify a directory organization object that holds info about the organization. The schema needed for this is described below in section 5.2 ✨

The subordinates of that DN are directory objects related to the organization. The domain component attribute can name subdivisions of the organization, like organizational units and localities. For example, Acme might use the domain names "corporate.acme.com" and "richmond.acme.com" to build these names, where it places its directory objects:

dc=corporate, dc=acme, dc=com
dc=richmond, dc=acme, dc=com

The schema needed to name organizationalUnit and locality objects this way is described below in section 5.2 🎀

Subdivisions like organizational units and localities could also get RDNs using the conventional X.500 naming attributes, like this:

ou=corporate, dc=acme, dc=com
l=richmond, dc=acme, dc=com.

Using the dc attribute for the RDN of directory objects of class "domain" is possible too [1] 🧚

4.2 User ID (uid) 🪪

The userid (uid) attribute is defined and registered in RFC1274 [3][10] 💜

You can use this attribute to build the RDN for directory objects that sit under objects named with the procedure from Section 4.1. This plan doesn't constrain how you use it, so you have freedom here 🦋

4.3 Common Name (cn) 🌸

The commonName (cn) attribute is defined and registered in X.500 [3][11] 🍓

Same deal as uid: you can use this attribute to build the RDN for directory objects under objects named via Section 4.1. This plan doesn't constrain how it's used 💅

4.4 Examples of uid and cn Usage ✨

The plan doesn't put any constraints on how you use uid and cn for name construction, but we'd like to give some suggestions through examples 🫶

In practice, we've used uid as the RDN for person objects where we could tap into an existing registry of names, and cn for everything else 🌈

Examples of existing registries of identifiers for person objects are RFC822 mailbox identifiers, employee numbers and employee "handles". Besides being convenient for admins (reusing an existing store of identifiers is so much easier), if you ever need to show a user their DN, there's some hope they'll recognize it when these identifiers are used 🎀

RFC822 mailbox identifiers are a particularly convenient source for building names 💖 When a person has several email addresses, one gets picked for user identification. We call this the "distinguished" e-mail address, or the "distinguished" RFC822 mailbox identifier for the user 🦋

Here's an example. Say there's a user affiliated with Acme whose distinguished e-mail address is J.Smith@acme.com. Their uid attribute will be:

uid=J.Smith@acme.com

A user's DN domain components will normally come from the domain name of their distinguished e-mail address. So for uid=J.Smith@acme.com, the domain components would typically be:

dc=acme, dc=com

The full LDAP DN for this user would then be:

uid=J.Smith@acme.com, dc=acme, dc=com

When directory admins have several RFC822 identifiers to pick from for a user's DN, they should consider these factors:

• Machine-independent addresses are likely to be more stable, which means directory names change less. So an identifier like this:

js@acme.com

may well be preferable to one like this:

js@blaster.third-floor.acme.com.

• Using some form of "handle" for the "local" part that's different from a user's real name may mean fewer collisions, and that saves users a lot of pain and suffering 😭 So the identifier:

js@acme.com

may well be preferable to one like this:

J.Smith@acme.com

Real-world experience with the RFC822 mailbox identifier scheme described here shows there are situations where it's handy to use these identifiers for all users in a population, even though a few users don't actually have working mailboxes 🙈 For example, an organization might have an existing unique ID scheme for all employees that works as an alias for each employee's real mailbox, and those real mailboxes might be super heterogeneous in structure. The ID scheme identifies each employee unambiguously, but it only works as an email alias for employees who actually have real mailboxes. Because of that, it would be a bad assumption for directory-enabled apps to treat the uid as a valid mailbox. The value(s) of the mail attribute should always be checked 💅

Important to emphasize: the elements of the domain name in an RFC822 identifier may, BUT NEED NOT, match the domain components of the DN 🌸 That means the domain components give you some freedom to support access control or other directory structuring needs that don't have to show up in the user's e-mail address. We do not want, under any condition, to force a user's e-mail address to change just to support a new system requirement, like a change in an access control structure 😭 It's also worth noting that while we don't REQUIRE the domain components to match the RFC822 identifier, we DO require that the concatenated domain components form a registered domain name, meaning one that's represented in the DNS. This automatically avoids name conflicts in the directory hierarchy ✨

Here's an example of a DN that goes off the default structure, so get ready 🧚

Say J.Smith needs special permissions for information in the dc=acme, dc=com part of the LDAP DIT. Since it's generally easier to organize special users by their name structure than by groups (an arbitrary collection of DNs), we use subdomains for this 🌈 Say those special permissions are needed by users in the MIS organizational unit. A subdomain "mis.acme.com" gets established, if it doesn't already exist, following normal DNS procedures. The special permissions will be granted to users with this name structure:

uid=*, dc=mis, dc=acme, dc=com

J.Smith's DN in this case will be:

uid=J.Smith@acme.com, dc=mis, dc=acme, dc=com

In principal (the original spells it that way 😉), nothing stops the domain name elements of the RFC822 identifier from being totally different from the DN's domain components. For instance, a J.Smith's DN could be:

uid=J.Smith@worldnet.att.net, dc=mis, dc=acme, dc=com

We do not REQUIRE the domain name part of the uid to match the dc components of the directory distinguished name, but we suggest matching them where possible 🎀 At a minimum, if the most significant pieces of the DN and the uid are the same (like "dc=acme, dc=com" and "acme.com"), then based on a user's e-mail address, it's way easier to find an appropriate directory system to contact for info about that user 💖

The example above is a situation where this suggestion isn't possible, because some users in the population have mailbox identifiers that don't follow the pattern of the rest. For example, most mailboxes look like local@acme.com, but a subpopulation has mailboxes from an ISP, so they look like local@worldnet.att.net 🦋

5.0 Naming Plan and Directories 🗂️✨

5.1 Directory Services Considerations 🌐

okay so we're picturing LDAP-based directory services on the Internet as loosely coupled LDAP servers 💖 And the coupling happens at two levels.

Firstly, LDAP servers get loosely connected into islands (aka a set of servers sharing a single DN namespace) 🏝️ The glue holding the islands together is LDAP referral [12] information configured into the LDAP servers. So if an LDAP search hits a server that doesn't have the info, that server can answer with an LDAP referral to another, more appropriate server in the same island ✨

Secondly, various techniques will be used to span LDAP islands 🦋 The concept that makes those techniques work is the LDAP URL [13]. By combining a DNS host name and port (corresponding to one or more LDAP servers) with a DN, the LDAP URL gives you a unified high-level identification scheme (an LDAP URL namespace) for directory objects 🎀

Because an LDAP referral is expressed as one or more LDAP URLs, these two levels of coupling may not be sharply distinguished in practice 🤷‍♀️

We do not envision the X.500 model of a single DIT (i.e. a single DN namespace) being viable in an environment of competing service providers 🙅‍♀️ This naming plan doesn't try to produce DNs that hide the possibility that a given real-world object may have independently managed directory objects with the same DN associated with it 👀

5.2 Directory Schema Implications of the Naming Plan 📚

The traditional directory schema(s) developed for the X.500 standard and its application to the Internet [4] need extending before they can be used with the naming plan we came up with here 🛠️ The extensions below try really hard to reuse existing schema elements. The directory objects that need extensions are: organization, organizational unit, and various classes of leaf objects. We'll walk through the schema changes for organization, organizationalUnit and selected leaf classes 💅

To keep using existing structural object classes as much as possible, we propose adding extra info to entries based on those classes using two new auxiliary object classes, dcObject and uidObject 🧚 They're specified using the notation in Section 4 of [14].

The auxiliary object class dcObject is defined in "Using Domains in LDAP Distinguished Names" [1].

The auxiliary object class uidObject is defined as:

( 1.3.6.1.1.3.1
  NAME uidObject
  SUP top
  AUXILIARY
  MUST uid )

5.2.1 Organization Schema 🏢

The dc attribute is used to construct the RDN of an organization object. You turn this on by adding the auxiliary class dcObject to the organization's objectClass attribute 💖

5.2.2 Organizational Unit Schema 🗂️

The dc attribute is used to construct the RDN of an organizationalUnit object (which sits in the DIT under either an organization or an organizationalUnit object) 🌸 This is enabled by adding the auxiliary class dcObject to the organizational unit's objectClass attribute.

5.2.3 Person Schema 🙋‍♀️

No schema extensions are needed for person objects if you're using either the inetOrgPerson [15] (preferred) or the newPilotPerson object classes 🙌 The uid attribute is allowed in each class. For consistency, the uidObject could be added to person entry objectClass attributes so apps filtering on this object class attribute value have an easier time 🔍 Using other classes for person objects with an RDN built from the uid attribute, like organizationalPerson, requires the uidObject class.

Traditionally, X.500 and LDAP directory services have used the common name (cn) attribute for naming 📛 This naming plan doesn't require cn in naming, but it should be stressed that it's a required attribute in any class derived from the person class, and it's still super important 😭 It plays a big role in letting people search for the user entries they're looking for 🔥

5.2.4 Certification Authority Schema 🔐

The certification authority (CA) object class is an auxiliary class, which basically means it's a bundle of extra attributes for a base class like organizationalRole, organization, organizationalUnit or person 🧁 Unless the base structural class is inetOrgPerson, using the uid attribute to construct the RDN of a CA means you'll need the auxiliary class uidObject so the uid attribute is allowed 🫶 When organizationalUnit or organization is the base class for a CA, the auxiliary class dcObject lets the CA's RDN be a domain component 🌈

5.2.5 Server and Server Application Schema 🖥️

Servers and server applications usually get represented, for want of anything better, by entries of the object class applicationProcess (or a class derived from it) 🤷‍♀️ Sometimes the class applicationEntity gets used instead. Either way, the uid attribute probably shouldn't be used to construct the RDN of a server or server application object. The standard schema uses the attribute cn for these RDNs 💅

Now, suppose you want to use this naming plan both for building DNs for SSL server certificates AND for storing them in a directory 👀 Clients connecting over SSL customarily compare the server's domain name (e.g. from the URL used to contact the server) with the value of the cn attribute in the subject field (i.e. subject's DN) of the server's certificate. Because of that, it's common practice to set the cn attribute to the server's domain name 🔑

An example makes this way clearer. Take the server "host.acme.com". Following the algorithm in "Using Domains in LDAP Distinguished Names" [1], the DN dc=host, dc=acme, dc=com gets constructed. To match the existing practices we just described, the server's subject DN for the SSL server certificate should be cn=host.acme.com, dc=host, dc=acme, dc=com, and the server's certificate should be stored in a directory entry with this name. That entry should use application process or application entity as its structural object class, and strong authentication user as its auxiliary class 🎀

5.2.6 Name Forms 📝

For X.500 servers, or LDAP servers following the X.500 model, our schema needs new name forms, structure rules, and DIT content rules ✨ Structure rules and DIT content rules are defined locally and don't involve a globally significant object identifier 🌍

The name forms below use the syntax of section 6.22 of [14], just to make life easier for anyone running those servers 💖

Heads up: since the structural object classes organization, organizationalUnit, locality and organizationalPerson don't allow the dc attribute to be included, an auxiliary object class such as dcObject [1] must be used for instances of these classes.)

⚠️ Yep, that closing parenthesis in the note above is part of the original text, so it stays.

5.2.6.1 Name Form for Domain Objects 🌐

The OIDs in this group live under the iso.org.dod.internet.directory.NameForm branch of the OID tree (1.3.6.1.1.2) 🌳

( 1.3.6.1.1.2.1
  NAME domainNameForm
  OC domain
  MUST dc )

The domainNameForm name form says that objects of structural object class domain have their RDN constructed from a value of the attribute dc 🫶

5.2.6.2 Name Form for Organization Objects 🏢

( 1.3.6.1.1.2.2
  NAME dcOrganizationNameForm
  OC organization
  MUST dc )

The dcOrganizationNameForm name form says that objects of structural object class organization have their RDN constructed from a value of the attribute dc 💅

5.2.6.3 Name Form for Organizational Unit Objects 🗂️

( 1.3.6.1.1.2.3
  NAME dcOrganizationalUnitNameForm
  OC organizationalUnit
  MUST dc )

The dcOrganizationalUnitNameForm name form says that objects of structural object class organizationalUnit have their RDN constructed from a value of the attribute dc 🌸

5.2.6.4 Name Form for Locality Objects 📍

( 1.3.6.1.1.2.4
  NAME dcLocalityNameForm
  OC locality
  MUST dc )

The dcLocalityNameForm name form says that objects of structural object class locality have their RDN constructed from a value of the attribute dc 🦋

5.2.6.5 Name Form for Organizational Person Objects 🙋‍♀️

( 1.3.6.1.1.2.5
  NAME uidOrganizationalPersonNameForm
  OC organizationalPerson
  MUST uid )

The uidOrganizationalPersonNameForm name form says that objects of structural object class organizationalPerson have their RDN constructed from a value of the attribute uid 💖

---

6.0 Security Considerations 🔒

Okay, this part is serious bestie 😤 Even if you put access controls on parts of the DIT to stop unauthorized clients from browsing, it may still be possible to infer directory names and DIT structure in those sensitive parts from the results of DNS queries 👀 And making some parts of the DIT publicly visible may help those making such inferences 🙈

7.0 Acknowledgments 🫶

This plan came out of a bunch of fruitful discussions, especially with David Chadwick, John Dale, Joe Gajewski, Mark Jackson, Ryan Moats, Tom Spencer and Chris Tzu 💜 Shoutout to all of them, they're iconic 👑

8.0 References 📚

• [1] Kille, S., Wahl, M., Grimstad, A., Huber, R., and S. Sataluri, "Using Domains in LDAP Distinguished Names", RFC 2247, January 1998.
• [2] X.500: The Directory -- Overview of Concepts, Models, and Service, CCITT Recommendation X.500, December, 1988.
• [3] Barker, P., and S. Kille, "The COSINE and Internet X.500 Schema", RFC 1274, November 1991.
• [4] The North American Directory Forum, "A Naming Scheme for c=US", RFC 1255, September 1991.
• [5] The North American Directory Forum, "NADF Standing Documents: A Brief Overview", RFC 1417, February 1993.
• [6] Yeong, W., Howes, T., and S. Kille, "Lightweight Directory Access Protocol", RFC 1777, March 1995.
• [7] Wahl, M., Howes, T., and S. Kille, "Lightweight Directory Access Protocol (v3)", RFC 2251, December 1997.
• [8] Kille, S., "A String Representation of Distinguished Names", RFC 1779, March 1995.
• [9] Wahl, M., Kille, S., and T. Howes, "Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names", RFC 2253, December 1997.
• [10] Wahl, M., "A Summary of the Pilot X.500 Schema for use in LDAPv3", Work in Progress.
• [11] Wahl, M., "A Summary of the X.500 User Schema for use with LDAPv3", RFC 2256, December 1997.
• [12] Howes, T., and M. Wahl, "Referrals and Knowledge References in LDAP Directories", Work in Progress.
• [13] Howes, T., and M. Smith, "The LDAP URL Format", RFC 2255, December 1997.
• [14] Wahl, M., Coulbeck, A., Howes, T., and S. Kille, "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997.
• [15] Smith, M., "Definition of the inetOrgPerson Object Class", Work in Progress.

12. Authors' Addresses ✍️

Al Grimstad
AT&T
Room 1C-429, 101 Crawfords Corner Road
Holmdel, NJ 07733-3030
USA

EMail:  alg@att.com


Rick Huber
AT&T
Room 1B-433, 101 Crawfords Corner Road
Holmdel, NJ 07733-3030
USA

EMail:  rvh@att.com


Sri Sataluri
Lucent Technologies
Room 4D-335, 101 Crawfords Corner Road
Holmdel, NJ 07733-3030
USA

EMail:  srs@lucent.com


Mark Wahl
Critical Angle Inc.
4815 W Braker Lane #502-385
Austin, TX 78759
USA

EMail:  M.Wahl@critical-angle.com

13. Full Copyright Statement ✨

Copyright (C) The Internet Society (1998). All Rights Reserved. 🌈

Okay bestie, the legal stuff is actually pretty generous 💖. You can copy this document and share it with anyone. You can also make derivative works that comment on it, explain it, or help people build it, and you can publish and distribute those too, in whole or in part, with no restrictions at all. The only catch is that the copyright notice and this paragraph have to stay on every copy and every derivative work 🎀.

The original document itself is a different story 🙈. Nobody can modify it in any way, like deleting the copyright notice or the references to the Internet Society or other Internet organizations. There are two exceptions. First, you can modify it to develop Internet standards, but then you have to follow the copyright procedures in the Internet Standards process 🧚. Second, you can translate it into languages other than English 🌸.

The permissions I just listed are perpetual, which means the Internet Society and its successors or assigns will never take them back 💜.

⚠️ Big disclaimer, bestie: this document and everything in it is provided "AS IS". The Internet Society and the Internet Engineering Task Force say no to all warranties, express or implied. That includes any promise that using the information won't infringe anyone's rights, and any implied warranties of merchantability or fitness for a particular purpose 💀.