RFC 3671
Collective Attributes in the Lightweight Directory Access Protocol (LDAP)
RFC 3671: Collective Attributes in LDAP 💖
Okay bestie, let's get the title block out of the way first 🎀. This doc is by K. Zeilenga from the OpenLDAP Foundation, dated December 2003, and it's on the Standards Track 🦋. It's an RFC from the Network Working Group, so it's an official Internet standard, not just a suggestion 👑. The title block doesn't list anything it obsoletes or updates.
Status of This Memo ✨
Okay so this bit says it's an Internet standards track protocol for the Internet community, and it wants feedback and ideas for making it better 🫶. If you want to know where it sits in the official standards world, check the current edition of "Internet Official Protocol Standards" (STD 1) 📚. And yes, you're allowed to share it around, distribution is unlimited 💅.
Copyright Notice 🌸
The Internet Society owns the copyright here (2003) and all rights are reserved 💜.
Abstract 🧚
X.500 collective attributes let a bunch of entries share the same characteristics as a group 💖. This doc sums up the X.500 information model for collective attributes, explains how to use them in LDAP (Lightweight Directory Access Protocol), and gives the schema definitions you'll need for LDAP 🎀.
1. Introduction ✨
In X.500 [X.500], a collective attribute is "a user attribute whose values are the same for each member of an entry collection" [X.501] 🦋. This document explains how to use them in the Lightweight Directory Access Protocol (LDAP) [RFC3377] 💅.
1.1. Entry Collections 🌈
An entry collection is a group of object and alias entries that are grouped together because they share some common properties or a relationship, and they share certain attributes 🫶. Basically, the collection is everything inside the scope of a collective attributes subentry [RFC3672] 🍓. The really iconic part is that one entry can belong to several entry collections at once 🔥.
1.2. Collective Attributes 💖
The attributes that the entries in an entry collection all share are called collective attributes ✨. Clients who access entries in the collection can see the values, but they can't update them 👀. You change collective attributes through their collective attributes subentry, and that's the only way 🎀.
When an entry is in multiple entry collections, its values for each collective attribute get merged together, so clients never see that the values came from different places 🧚.
An entry can also opt out of a particular collective attribute by listing that attribute as a value of the collectiveExclusions attribute 🙈. Like any other user attribute, collective attributes are covered by all sorts of controls, including access, administrative, and content controls 🔐.
1.3. Conventions 🍓
The schema definitions use LDAPv3 [RFC2251] description formats [RFC2252] 💜. The definitions in this doc are line wrapped so they're easier to read ✨.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] 🦋.
2. System Schema for Collective Attributes 👑
The following operational attributes are used to manage collective attributes 💅. LDAP servers [RFC3377] MUST act in accordance with the X.500 Directory Models [X.501] when they provide this service 🔥.
2.1. collectiveAttributeSubentry 🎀
Subentries of this object class are used to administer collective attributes, and they're called collective attribute subentries 🧚.
( 2.5.17.2 NAME 'collectiveAttributeSubentry' AUXILIARY )A collective attribute subentry SHOULD contain at least one collective attribute 💖. The collective attributes inside a subentry can be found, searched, and compared at every entry in the subentry's scope 👀. But they're changed (modified) through the subentry itself 🫶.
Implementations of this specification SHOULD support collective attribute subentries in both collectiveAttributeSpecificArea (2.5.23.5) and collectiveAttributeInnerArea (2.5.23.6) administrative areas [RFC3672][X.501] 🌸.
2.2. collectiveAttributeSubentries 🌈
The collectiveAttributeSubentries operational attribute lists every collective attribute subentry that affects the entry ✨.
( 2.5.18.12 NAME 'collectiveAttributeSubentries'
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
USAGE directoryOperation NO-USER-MODIFICATION )2.3. collectiveExclusions 🙈
The collectiveExclusions operational attribute lets particular collective attributes be excluded from an entry 🚫. It MAY appear in any entry and MAY have multiple values 💅.
( 2.5.18.7 NAME 'collectiveExclusions'
EQUALITY objectIdentifierMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.38
USAGE directoryOperation )The descriptor excludeAllCollectiveAttributes goes with the OID 2.5.18.0 🦋. If that descriptor or OID shows up as a value of collectiveExclusions, then every collective attribute gets excluded from the entry 💀.
3. Collective Attribute Types 💜
An attribute type in userApplications can be defined as COLLECTIVE [RFC2252] 🎀. That means the same attribute values show up in the entries of an entry collection, unless collectiveExclusions or other administrative controls step in 🧚. Those administrative controls MAY include DIT Content Rules, if they're implemented 🌸.
Collective attribute types are usually defined as subtypes of non-collective attribute types 🌈. By convention, a collective attribute gets named by putting "c-" in front of the name of its non-collective supertype ✨. For example, the collective telephone attribute is named c-TelephoneNumber, after its non-collective supertype telephoneNumber 📞.
Non-collective attribute types SHALL NOT subtype collective attributes 🙅. Collective attributes SHALL NOT be SINGLE-VALUED 🙅. Collective attribute types SHALL NOT appear in the attribute types of an object class definition 🙅.
Operational attributes SHALL NOT be defined as collective 🙅.
The rest of this section summarizes the collective attributes that come from the ones defined in [X.520] 💅. The SUPerior attribute types are described in [RFC 2256] for use with LDAP 🫶.
Implementations of this specification SHOULD support the following collective attributes, and they MAY support additional collective attributes too 🔥.
3.1. Collective Locality Name 🌸
The c-l attribute type gives a locality name for a collection of entries 📍.
( 2.5.4.7.1 NAME 'c-l'
SUP l COLLECTIVE )3.2. Collective State or Province Name 🗺️
The c-st attribute type gives a state or province name for a collection of entries 🌈.
( 2.5.4.8.1 NAME 'c-st'
SUP st COLLECTIVE )3.3. Collective Street Address 🏡
The c-street attribute type gives a street address for a collection of entries 🍓.
( 2.5.4.9.1 NAME 'c-street'
SUP street COLLECTIVE )3.4. Collective Organization Name 🏢
The c-o attribute type gives an organization name for a collection of entries 💜.
( 2.5.4.10.1 NAME 'c-o'
SUP o COLLECTIVE )3.5. Collective Organizational Unit Name 🧩
The c-ou attribute type gives an organizational unit name for a collection of entries 🎀.
( 2.5.4.11.1 NAME 'c-ou'
SUP ou COLLECTIVE )3.6. Collective Postal Address ✉️
The c-PostalAddress attribute type gives a postal address for a collection of entries 💌.
( 2.5.4.16.1 NAME 'c-PostalAddress'
SUP postalAddress COLLECTIVE )3.7. Collective Postal Code 📮
The c-PostalCode attribute type gives a postal code for a collection of entries 🌸.
( 2.5.4.17.1 NAME 'c-PostalCode'
SUP postalCode COLLECTIVE )3.8. Collective Post Office Box 📫
The c-PostOfficeBox attribute type gives a post office box for a collection of entries 🦋.
( 2.5.4.18.1 NAME 'c-PostOfficeBox'
SUP postOfficeBox COLLECTIVE )3.9. Collective Physical Delivery Office Name 🏣
The c-PhysicalDeliveryOfficeName attribute type gives a physical delivery office name for a collection of entries ✨.
( 2.5.4.19.1 NAME 'c-PhysicalDeliveryOfficeName'
SUP physicalDeliveryOfficeName COLLECTIVE )3.10. Collective Telephone Number ☎️
The c-TelephoneNumber attribute type gives a telephone number for a collection of entries 💖.
( 2.5.4.20.1 NAME 'c-TelephoneNumber'
SUP telephoneNumber COLLECTIVE )3.11. Collective Telex Number 📠
The c-TelexNumber attribute type gives a telex number for a collection of entries 🧚.
( 2.5.4.21.1 NAME 'c-TelexNumber'
SUP telexNumber COLLECTIVE )3.13. Collective Facsimile Telephone Number 📠
The c-FacsimileTelephoneNumber attribute type gives a facsimile telephone number for a collection of entries 🌈.
( 2.5.4.23.1 NAME 'c-FacsimileTelephoneNumber'
SUP facsimileTelephoneNumber COLLECTIVE )3.14. Collective International ISDN Number 📞
The c-InternationalISDNNumber attribute type gives an international ISDN number for a collection of entries 🍓.
( 2.5.4.25.1 NAME 'c-InternationalISDNNumber'
SUP internationalISDNNumber COLLECTIVE )4. Security Considerations 🔐
Collective attributes are just like other attributes: they're subject to access control restrictions and other administrative policy, and this is a big deal 🚨. Generally speaking, collective attributes you get through an entry in a collection are governed by the same rules that restrict access to that entry's attributes 🔒. Collective attributes you get through a subentry are governed by the rules that restrict access to that subentry's attributes 🗝️. But LDAP doesn't have a standard access model, so the details of each server's access control system may be different 💀.
General LDAP security considerations [RFC3377] also apply, so don't skip them 👀.
5. IANA Considerations 🦋
The IANA has registered the LDAP descriptors [RFC3383] defined in this technical specification 🎉. The following registration template is suggested 💅:
Subject: Request for LDAP Descriptor Registration
Descriptor see comments
Object Identifier: see comment
Person & email address to contact for further information:
Kurt Zeilenga <kurt@OpenLDAP.org>
Usage: see comment
Specification: RFC3671
Author/Change Controller: IESG
Comments:
NAME Type OID
------------------------ ---- -----------------
c-FacsimileTelephoneNumber A 2.5.4.23.1
c-InternationalISDNNumber A 2.5.4.25.1
c-PhysicalDeliveryOffice A 2.5.4.19.1
c-PostOfficeBox A 2.5.4.18.1
c-PostalAddress A 2.5.4.16.1
c-PostalCode A 2.5.4.17.1
c-TelephoneNumber A 2.5.4.20.1
c-TelexNumber A 2.5.4.21.1
c-l A 2.5.4.7.1
c-o A 2.5.4.10.1
c-ou A 2.5.4.11.1
c-st A 2.5.4.8.1
c-street A 2.5.4.9.1
collectiveAttributeSubentries A 2.5.18.12
collectiveAttributeSubentry O 2.5.17.2
collectiveExclusions A 2.5.18.7
where Type A is Attribute and Type O is ObjectClass.The Object Identifiers used in this document were assigned by the ISO/IEC Joint Technical Committee 1 - Subcommittee 6 to identify elements of X.500 schema [X.520] 🌸. This document makes no OID assignments. It only provides LDAP schema descriptions using existing elements of the X.500 schema 💖.
6. Intellectual Property Statement 💅
okay bestie, the IETF is basically saying "we are NOT picking sides on who owns what" 🙅♀️✨ They take no position on whether any intellectual property or other rights someone claims over the tech in this doc are valid, or how far any license under those rights might extend (or whether one exists at all). They also don't claim they went looking for any such rights. 🕵️♀️
If you want the procedures for rights in standards-track and standards-related documents, check out BCP-11 🦋 And if you need copies of claimed rights that were submitted for publication, any assurances that licenses will be made available, or the outcome of an attempt to get a general license or permission for implementers or users of this spec to use those proprietary rights, you can request them from the IETF Secretariat 💌
The IETF also invites any interested party to flag any copyrights, patents, patent applications, or other proprietary rights that might cover technology required to practice this standard. Send that info to the IETF Executive Director 🫶
7. Acknowledgments 🌸
This document is built on the ITU Recommendations for the Directory, [X.501][X.520]. Big thanks to those folks! 🙌
8. References 📚
8.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory
Access Protocol (v3)", RFC 2251, December 1997.
[RFC2252] Wahl, M., Coulbeck, A., Howes, T. and S. Kille,
"Lightweight Directory Access Protocol (v3): Attribute
Syntax Definitions", RFC 2252, December 1997.
[RFC2256] Wahl, M., "A Summary of the X.500(96) User Schema for use
with LDAPv3", RFC 2256, December 1997.
[RFC3377] Hodges, J. and R. L. Morgan, "Lightweight Directory Access
Protocol (v3): Technical Specification", RFC 3377,
September 2002.
[RFC3383] Zeilenga, K., "Internet Assigned Numbers Authority (IANA)
Considerations for the Lightweight Directory Access
Protocol (LDAP)", BCP 64, RFC 3383, September 2002.
[RFC3672] Zeilenga, K. and S. Legg, "Subentries in Lightweight
Directory Access Protocol (LDAP)", RFC 3672, December
2003.
[X.501] "The Directory: Models", ITU-T Recommendation X.501, 1993.8.2. Informative References
[X.500] "The Directory: Overview of Concepts, Models", ITU-T
Recommendation X.500, 1993.
[X.520] "The Directory: Selected Attribute Types", ITU-T
Recommendation X.520, 1993.9. Author's Address ✍️
Kurt D. Zeilenga
OpenLDAP Foundation
EMail: Kurt@OpenLDAP.org10. Full Copyright Statement ©️
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished to others 💖 Derivative works that comment on or explain it, or help with implementing it, may be prepared, copied, published and distributed, in whole or in part, with no restrictions of any kind, as long as the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way (no deleting the copyright notice or the references to the Internet Society or other Internet organizations). The exception is when needed to develop Internet standards, in which case the copyright procedures in the Internet Standards process must be followed, or when translating it into languages other than English 🌍
The limited permissions above are perpetual and will not be revoked by the Internet Society or its successors or assignees. ♾️
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 🌷
Funding for the RFC Editor function is currently provided by the Internet Society. Thank you, Internet Society! 🫶✨
📦 where this page comes from
- ietf: rfc3671 2003-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms