1. Introduction

This document discusses the X.500 Directory Information Models [X.501], as used by the Lightweight Directory Access Protocol (LDAP) [RFC4510].

The Directory is "a collection of open systems cooperating to provide directory services" [X.500]. The information held in the Directory is collectively known as the Directory Information Base (DIB). A Directory user, which may be a human or other entity, accesses the Directory through a client (or Directory User Agent (DUA)). The client, on behalf of the directory user, interacts with one or more servers (or Directory System Agents (DSA)). A server holds a fragment of the DIB.

The DIB contains two classes of information:

  1) user information (e.g., information provided and administrated
     by users).  Section 2 describes the Model of User Information.

  2) administrative and operational information (e.g., information
     used to administer and/or operate the directory).  Section 3
     describes the model of Directory Administrative and Operational
     Information.

These two models, referred to as the generic Directory Information Models, describe how information is represented in the Directory. These generic models provide a framework for other information models. Section 4 discusses the subschema information model and subschema discovery. Section 5 discusses the DSA (Server) Informational Model.

Other X.500 information models (such as access control distribution knowledge and replication knowledge information models) may be adapted for use in LDAP. Specification of how these models apply to LDAP is left to future documents.

1.1. Relationship to Other LDAP Specifications

This document is a integral part of the LDAP technical specification [RFC4510], which obsoletes the previously defined LDAP technical specification, RFC 3377, in its entirety.

This document obsoletes RFC 2251, Sections 3.2 and 3.4, as well as portions of Sections 4 and 6. Appendix A.1 summarizes changes to these sections. The remainder of RFC 2251 is obsoleted by the [RFC4511], [RFC4513], and [RFC4510] documents.

This document obsoletes RFC 2252, Sections 4, 5, and 7. Appendix A.2 summarizes changes to these sections. The remainder of RFC 2252 is obsoleted by [RFC4517].

This document obsoletes RFC 2256, Sections 5.1, 5.2, 7.1, and 7.2. Appendix A.3 summarizes changes to these sections. The remainder of RFC 2256 is obsoleted by [RFC4519] and [RFC4517].

This document obsoletes RFC 3674 in its entirety. Appendix A.4 summarizes changes since RFC 3674.

1.2. Relationship to X.501

This document includes material, with and without adaptation, from [X.501] as necessary to describe this protocol. These adaptations (and any other differences herein) apply to this protocol, and only this protocol.

1.3. Conventions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119].

Schema definitions are provided using LDAP description formats (as defined in Section 4.1). Definitions provided here are formatted (line wrapped) for readability. Matching rules and LDAP syntaxes referenced in these definitions are specified in [RFC4517].

1.4. Common ABNF Productions

A number of syntaxes in this document are described using Augmented Backus-Naur Form (ABNF) [RFC4234]. These syntaxes (as well as a number of syntaxes defined in other documents) rely on the following common productions:

  keystring = leadkeychar *keychar
  leadkeychar = ALPHA
  keychar = ALPHA / DIGIT / HYPHEN
  number  = DIGIT / ( LDIGIT 1*DIGIT )

  ALPHA   = %x41-5A / %x61-7A   ; "A"-"Z" / "a"-"z"
  DIGIT   = %x30 / LDIGIT       ; "0"-"9"
  LDIGIT  = %x31-39             ; "1"-"9"
  HEX     = DIGIT / %x41-46 / %x61-66 ; "0"-"9" / "A"-"F" / "a"-"f"

  SP      = 1*SPACE  ; one or more " "
  WSP     = 0*SPACE  ; zero or more " "

  NULL    = %x00 ; null (0)
  SPACE   = %x20 ; space (" ")
  DQUOTE  = %x22 ; quote (""")
  SHARP   = %x23 ; octothorpe (or sharp sign) ("#")
  DOLLAR  = %x24 ; dollar sign ("$")
  SQUOTE  = %x27 ; single quote ("'")
  LPAREN  = %x28 ; left paren ("(")
  RPAREN  = %x29 ; right paren (")")
  PLUS    = %x2B ; plus sign ("+")
  COMMA   = %x2C ; comma (",")
  HYPHEN  = %x2D ; hyphen ("-")
  DOT     = %x2E ; period (".")
  SEMI    = %x3B ; semicolon (";")
  LANGLE  = %x3C ; left angle bracket ("<")
  EQUALS  = %x3D ; equals sign ("=")
  RANGLE  = %x3E ; right angle bracket (">")
  ESC     = %x5C ; backslash ("\")
  USCORE  = %x5F ; underscore ("_")
  LCURLY  = %x7B ; left curly brace "{"
  RCURLY  = %x7D ; right curly brace "}"

  ; Any UTF-8 [RFC3629] encoded Unicode [Unicode] character
  UTF8    = UTF1 / UTFMB
  UTFMB   = UTF2 / UTF3 / UTF4
  UTF0    = %x80-BF
  UTF1    = %x00-7F
  UTF2    = %xC2-DF UTF0
  UTF3    = %xE0 %xA0-BF UTF0 / %xE1-EC 2(UTF0) /
            %xED %x80-9F UTF0 / %xEE-EF 2(UTF0)
  UTF4    = %xF0 %x90-BF 2(UTF0) / %xF1-F3 3(UTF0) /
            %xF4 %x80-8F 2(UTF0)

  OCTET   = %x00-FF ; Any octet (8-bit data unit)

Object identifiers (OIDs) [X.680] are represented in LDAP using a dot-decimal format conforming to the ABNF:

  numericoid = number 1*( DOT number )

Short names, also known as descriptors, are used as more readable aliases for object identifiers. Short names are case insensitive and conform to the ABNF:

  descr = keystring

Where either an object identifier or a short name may be specified, the following production is used:

  oid = descr / numericoid

While the form is generally preferred when the usage is restricted to short names referring to object identifiers that identify like kinds of objects (e.g., attribute type descriptions, matching rule descriptions, object class descriptions), the form should be used when the object identifiers may identify multiple kinds of objects or when an unambiguous short name (descriptor) is not available.

Implementations SHOULD treat short names (descriptors) used in an ambiguous manner (as discussed above) as unrecognized.

Short Names (descriptors) are discussed further in Section 6.2.