Lightweight Directory Access Protocol (LDAP): Structural Object Classes for Named Objects

Standards for LDAP directories often define additional schema elements, especially auxiliary object classes that are intended to hold various attributes needed by that standard. When adding entries with such an auxiliary object class it is up to the directory operator to choose an appropriate structural object class required to add the entry. Often the structural object classes used were defined for other purposes and thus seem too complex for this simple purpose. Inspired by unfinished this document defines structural object classes, 'namedObject' and 'namedPolicy'. Only attributes defined in and are used within these simple object classes. Arbitrary auxiliary object classes may be thus associated with entries which have such a structural object class. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . This document is being discussed on the ldapext@ietf.org mailing list.

The object classes definitions in this section are using the attributes 'cn' and 'description' defined in and 'uniqueIdentifier' defined in . If the optional attribute 'uniqueIdentifier' contains a value it SHOULD be used to form the RDN of the entry. Otherwise the mandantory attribute 'cn' SHOULD be used to form the RDN of the entry if there are no other appropriate naming attributes available. Other attributes allowed by auxiliary classes also MAY be used for naming purposes. LDAP clients displaying a list of entries of these object classes SHOULD use mandantory attribute 'cn' to display select lists, hyper-links etc.

The 'namedObject' object class definition is the basis of an entry that represents an arbitrary named object. The attribute 'cn' MUST be added to the entry. The attributes 'uniqueIdentifier' and 'description' MAY be added to the entry. ( 1.3.6.1.4.1.5427.1.389.6.20 NAME 'namedObject' SUP top STRUCTURAL MUST cn MAY ( uniqueIdentifier $ description ) )

The 'namedPolicy' object class definition is sub-classed from 'namedObject'. It SHOULD only be used for entries which represents an arbitrary policy. A typical example would be to use it along with auxiliary object class 'pwdPolicy' defined in . The rationale for an extra structural object class is to have the possibility to associate a specific set of policy-related auxiliary object classes without having to restrict the more general 'namedObject' class. ( 1.3.6.1.4.1.5427.1.389.6.21 NAME 'namedPolicy' SUP namedObject STRUCTURAL )

The 'namedObject' object class definition in this document supersedes the specification of the 'namedObject' in by L. Howard.

The OID arc used for the object class defintions is: iso(1) org(3) dod(6) internet(1) private(4) enter-prise(1) stroeder.com(5427) public(1) ldap(389) objectClasses(6)

The introduction of these object classes does not impact the security of the Internet or a particular LDAP directory service. Security considerations for LDAP in general are discussed in documents comprising the technical specification .