RFC 4530

Lightweight Directory Access Protocol (LDAP) entryUUID Operational Attribute

📅 published June 2006, from ietf

Lightweight Directory Access Protocol (LDAP) entryUUID Operational Attribute 🦋

Okay bestie, here's the deal: this RFC is the one that gives LDAP entries a permanent ID card, the entryUUID operational attribute 🪪✨ It's from June 2006 and it's a Standards Track document, so it's an actual Internet protocol spec, not just vibes. It was written by Kurt D. Zeilenga of the OpenLDAP Foundation, and it's filed under Network Working Group as RFC 4530. The header doesn't list any RFCs it obsoletes or updates, so it's standing on its own 💅

Status of This Memo

This doc specifies an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🗣️ If you want the current standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share it with your whole group chat 🌸

Copyright Notice

Abstract

Okay so this document describes the LDAP/X.500 'entryUUID' operational attribute, plus the matching rules and syntax that go with it 🔥 The attribute holds a UUID that the server assigns to each object. Clients can use it to tell apart objects that share a distinguished name, or to find an object after it's been renamed. Main character energy for identifiers 👑

1. Background and Intended Use .....................................2
2. UUID Schema Elements ............................................3
   2.1. UUID Syntax ................................................3
   2.2. 'uuidMatch' Matching Rule ..................................3
   2.3. 'uuidOrderingMatch' Matching Rule ..........................3
   2.4. 'entryUUID' Attribute ......................................4
3. Security Considerations .........................................4
4. IANA Considerations .............................................5
   4.1. Object Identifier Registration .............................5
   4.2. UUID Syntax Registration ...................................5
   4.3. 'uuidMatch' Descriptor Registration ........................5
   4.4. 'uuidOrderingMatch' Descriptor Registration ................5
   4.5. 'entryUUID' Descriptor Registration ........................6
5. Acknowledgements ................................................6
6. References ......................................................6
   6.1. Normative References .......................................6
   6.2. Informative References .....................................7

1. Background and Intended Use ✨

Okay, so in X.500 Directory Services [X.501], like the ones you can reach with the Lightweight Directory Access Protocol (LDAP) [RFC4510], an object is identified by its distinguished name (DN). The problem is DNs aren't stable IDs 😭 A brand-new object can end up with a DN that used to belong to a different object that got renamed or deleted. Honestly, that's chaotic.

A Universally Unique Identifier (UUID) is "an identifier unique across both space and time, with respect to the space of all UUIDs" [RFC4122]. UUIDs show up in a wide range of systems, so they're clearly a trusted ride 🚗

This document describes the 'entryUUID' operational attribute, which holds the UUID the server assigned to the object. Clients can use it to tell apart objects that have a particular distinguished name, or to track down a specific object after it's been renamed 🎯

This document defines the UUID syntax, the 'uuidMatch' and 'uuidOrderingMatch' matching rules, and the 'entryUUID' attribute type 💖

Schema definitions are written using LDAP description formats [RFC4512]. The definitions in here are line-wrapped so they're easier to read 📖

In this document, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are to be interpreted as described in BCP 14 [RFC2119]. Those words are the rules-lawyer words, so read them carefully 🧐

2. UUID Schema Elements 🎀

2.1. UUID Syntax

A Universally Unique Identifier (UUID) [RFC4122] is a 16-octet (128-bit) value that identifies an object. Here's how the ASN.1 [X.680] type UUID is defined to represent UUIDs:

    UUID ::= OCTET STRING (SIZE(16))
          -- constrained to an UUID [RFC4122]

In LDAP, UUID values are encoded using the [ASCII] character string representation described in [RFC4122]. For example, "597ae2f6-16a6-1027-98f4-d28b5365dc14" 🍓

Here's the LDAP syntax description, ready to go in subschema subentries 🧚

    ( 1.3.6.1.1.16.1 DESC 'UUID' )

2.2. 'uuidMatch' Matching Rule

The 'uuidMatch' matching rule compares an asserted UUID with a stored UUID for equality. Its semantics are the same as the 'octetStringMatch' [X.520][RFC4517] matching rule. The difference is that the assertion value is encoded using the UUID string representation instead of the normal OCTET STRING string representation 🔍

Here's the LDAP matching rule description, also ready for subschema subentries:

    ( 1.3.6.1.1.16.2 NAME 'uuidMatch'
        SYNTAX 1.3.6.1.1.16.1 )

2.3. 'uuidOrderingMatch' Matching Rule

The 'uuidOrderingMatch' matching rule compares an asserted UUID with a stored UUID for ordering. Its semantics are the same as the 'octetStringOrderingMatch' [X.520][RFC4517] matching rule. The difference is that the assertion value is encoded using the UUID string representation instead of the normal OCTET STRING string representation 📊

Here's the LDAP matching rule description for subschema subentries:

    ( 1.3.6.1.1.16.3 NAME 'uuidOrderingMatch'
        SYNTAX 1.3.6.1.1.16.1 )

Not every UUID variant has a defined ordering. And even when one does, servers aren't obligated to assign UUIDs in any particular order. This matching rule is only here for completeness 🤷‍♀️

2.4. 'entryUUID' Attribute

The 'entryUUID' operational attribute gives you the Universally Unique Identifier (UUID) assigned to the entry 🪪

Here's the LDAP attribute type description for subschema subentries:

    ( 1.3.6.1.1.16.4 NAME 'entryUUID'
        DESC 'UUID of the entry'
        EQUALITY uuidMatch
        ORDERING uuidOrderingMatch
        SYNTAX 1.3.6.1.1.16.1
        SINGLE-VALUE
        NO-USER-MODIFICATION
        USAGE directoryOperation )

Servers SHALL generate and assign a new UUID to each entry when it's added to the directory, and provide that UUID as the value of the 'entryUUID' operational attribute. An entry's UUID is immutable, so once it's set, it stays put 🔒

UUIDs are to be generated in accordance with Section 4 of [RFC4122]. In particular, servers MUST ensure that each generated UUID is unique in space and time ✨

Full Copyright Statement 💖

Okay bestie, the legal bit! 🎀 The Internet Society owns the copyright here, and it's dated 2006. ✨ Copyright (C) The Internet Society (2006).

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. 💅

The fine print says the document and the info in it are provided on an "AS IS" basis, and the contributor, the organization they represent or are sponsored by (if any), the Internet Society, and the Internet Engineering Task Force all disclaim every warranty, express or implied. 🙈 That covers warranties that using the information won't infringe any rights, and implied warranties of merchantability or fitness for a particular purpose. Here's the exact wording:

THIS DOCUMENT AND THE INFORMATION CONTAINED HEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🦋

Real talk, the IETF doesn't pick a side on whether any patents or other IP rights apply to the tech in this doc, or whether you can get a license for it. 🌸 It also hasn't gone looking for any of those rights itself. ngl that's a very responsible move. If you want the procedures for rights in RFC documents, check out BCP 78 and BCP 79. 📚

Copies of IPR disclosures sent to the IETF Secretariat, and any assurances of licenses that are going to be available, live in the IETF online IPR repository at http://www.ietf.org/ipr. The same goes for the result of any attempt to get a general license or permission to use those proprietary rights, for implementers or users of this spec. 🔥

The IETF also wants to hear from anyone who knows about copyrights, patents, patent applications or other proprietary rights that might cover tech needed to implement this standard. 👑 Send that info to the IETF at ietf-ipr@ietf.org. Be the helpful friend who speaks up! 🫶

Acknowledgement ✨

Funding for the RFC Editor function comes from the IETF Administrative Support Activity (IASA). 💜

📦 where this page comes from

ietf: rfc4530 2006-06
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms