mirror of
https://git.openldap.org/openldap/openldap.git
synced 2024-12-21 03:10:25 +08:00
228 lines
7.8 KiB
Plaintext
228 lines
7.8 KiB
Plaintext
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
INTERNET-DRAFT Kurt D. Zeilenga
|
|||
|
Intended Category: Standard Track OpenLDAP Foundation
|
|||
|
Expires in six months 17 May 2002
|
|||
|
|
|||
|
|
|||
|
|
|||
|
LDAP True/False Filters
|
|||
|
<draft-zeilenga-ldap-t-f-02.txt>
|
|||
|
|
|||
|
|
|||
|
Status of this Memo
|
|||
|
|
|||
|
This document is an Internet-Draft and is in full conformance with all
|
|||
|
provisions of Section 10 of RFC2026.
|
|||
|
|
|||
|
This document is intended to be, after appropriate review and
|
|||
|
revision, submitted to the RFC Editor as a Standard Track document.
|
|||
|
Distribution of this memo is unlimited. Technical discussion of this
|
|||
|
document will take place on the IETF LDAP Extensions Working Group
|
|||
|
mailing list <ietf-ldapext@netscape.com>. Please send editorial
|
|||
|
comments directly to the author <Kurt@OpenLDAP.org>.
|
|||
|
|
|||
|
Internet-Drafts are working documents of the Internet Engineering Task
|
|||
|
Force (IETF), its areas, and its working groups. Note that other
|
|||
|
groups may also distribute working documents as Internet-Drafts.
|
|||
|
Internet-Drafts are draft documents valid for a maximum of six months
|
|||
|
and may be updated, replaced, or obsoleted by other documents at any
|
|||
|
time. It is inappropriate to use Internet-Drafts as reference
|
|||
|
material or to cite them other than as ``work in progress.''
|
|||
|
|
|||
|
The list of current Internet-Drafts can be accessed at
|
|||
|
<http://www.ietf.org/ietf/1id-abstracts.txt>. The list of
|
|||
|
Internet-Draft Shadow Directories can be accessed at
|
|||
|
<http://www.ietf.org/shadow.html>.
|
|||
|
|
|||
|
Copyright 2002, The Internet Society. All Rights Reserved.
|
|||
|
|
|||
|
Please see the Copyright section near the end of this document for
|
|||
|
more information.
|
|||
|
|
|||
|
|
|||
|
Abstract
|
|||
|
|
|||
|
This document extends the Lightweight Directory Access Protocol (LDAP)
|
|||
|
to support absolute True and False filters based upon similar
|
|||
|
capabilities found in X.500 directory systems. The document also
|
|||
|
extends the String Representation of LDAP Search Filters to support
|
|||
|
these filters.
|
|||
|
|
|||
|
|
|||
|
|
|||
|
Zeilenga LDAP True/False Filters [Page 1]
|
|||
|
|
|||
|
INTERNET-DRAFT draft-zeilenga-ldap-t-f-02.txt 17 May 2002
|
|||
|
|
|||
|
|
|||
|
1. Background and Intended Use
|
|||
|
|
|||
|
The X.500 Directory Access Protocol (DAP) [X.511] supports absolute
|
|||
|
True and False assertions. An 'and' filter with zero elements always
|
|||
|
evaluates to True. An 'or' filter with zero elements always evaluates
|
|||
|
to False. These filters are commonly used when requesting DSA-
|
|||
|
specific Entries (DSEs) which do not necessarily have objectClass
|
|||
|
attributes. That is, where "(objectClass=*)" may evaluate to False.
|
|||
|
|
|||
|
While LDAPv2 [RFC1777] placed no restriction on the number of elements
|
|||
|
in 'and' and 'or' filter sets, the LDAPv2 string representation
|
|||
|
[RFC1960] could not represent empty 'and' and 'or' filter sets. Due
|
|||
|
to this, LDAPv3 [RFC2251] required 'and' and 'or' filter sets to have
|
|||
|
at least one element. Hence, LDAPv3 does not provide absolute True or
|
|||
|
False filters.
|
|||
|
|
|||
|
This documents extends LDAPv3 [RFC2251] to support absolute True and
|
|||
|
False matches by allowing empty 'and' and 'or' and extends the filter
|
|||
|
string representation [RFC2254] to allow empty filter lists.
|
|||
|
|
|||
|
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
|
|||
|
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
|
|||
|
document are to be interpreted as described in BCP 14 [RFC2119].
|
|||
|
|
|||
|
|
|||
|
2. Absolute True and False Filters
|
|||
|
|
|||
|
Implementations of this extension SHALL allow 'and' and 'or' choices
|
|||
|
with zero filter elements.
|
|||
|
|
|||
|
An 'and' Filter consisting of an empty set of filters SHALL evaluate
|
|||
|
to True. This filter is to represented by the string "(&)".
|
|||
|
|
|||
|
An 'or' Filter consisting of an empty set of filters SHALL evaluate to
|
|||
|
False. This filter is to represented by the string "(|)".
|
|||
|
|
|||
|
Servers supporting this feature SHOULD publish the Object Identifier
|
|||
|
1.3.6.1.4.1.4203.1.5.3 as a value of the supportedFeatures [FEATURES]
|
|||
|
attribute in the root DSE.
|
|||
|
|
|||
|
Clients supporting this feature SHOULD NOT use the feature unless they
|
|||
|
have knowledge the server supports it.
|
|||
|
|
|||
|
|
|||
|
3. Security Considerations
|
|||
|
|
|||
|
The (re)introduction of absolute True and False filters does not raise
|
|||
|
any new security considerations.
|
|||
|
|
|||
|
|
|||
|
|
|||
|
Zeilenga LDAP True/False Filters [Page 2]
|
|||
|
|
|||
|
INTERNET-DRAFT draft-zeilenga-ldap-t-f-02.txt 17 May 2002
|
|||
|
|
|||
|
|
|||
|
Implementors of this (or any) LDAP extension should be familiar with
|
|||
|
general LDAP general security considerations [LDAPTS].
|
|||
|
|
|||
|
|
|||
|
4. IANA Considerations
|
|||
|
|
|||
|
No IANA assignments are requested.
|
|||
|
|
|||
|
This document uses the OID 1.3.6.1.4.1.4203.1.5.3 to identify the
|
|||
|
feature described above. This OID was assigned [ASSIGN] by OpenLDAP
|
|||
|
Foundation under its IANA assigned private enterprise allocation
|
|||
|
[PRIVATE] for use in this specification.
|
|||
|
|
|||
|
|
|||
|
5. Author's Address
|
|||
|
|
|||
|
Kurt D. Zeilenga
|
|||
|
OpenLDAP Foundation
|
|||
|
<Kurt@OpenLDAP.org>
|
|||
|
|
|||
|
|
|||
|
6. Normative References
|
|||
|
|
|||
|
[RFC2119] S. Bradner, "Key words for use in RFCs to Indicate
|
|||
|
Requirement Levels", BCP 14 (also RFC 2119), March 1997.
|
|||
|
|
|||
|
[RFC2251] M. Wahl, T. Howes, S. Kille, "Lightweight Directory Access
|
|||
|
Protocol (v3)", RFC 2251, December 1997.
|
|||
|
|
|||
|
[RFC2254] T. Howes, "A String Representation of LDAP Search Filters",
|
|||
|
RFC 2254, December 1997.
|
|||
|
|
|||
|
[LDAPTS] J. Hodges, R. Morgan, "Lightweight Directory Access
|
|||
|
Protocol (v3): Technical Specification",
|
|||
|
draft-ietf-ldapbis-ldapv3-ts-xx.txt (a work in progress).
|
|||
|
|
|||
|
[FEATURES] K. Zeilenga, "Feature Discovery in LDAP",
|
|||
|
draft-zeilenga-ldap-features-xx.txt (a work in progress).
|
|||
|
|
|||
|
|
|||
|
7. Informative References
|
|||
|
|
|||
|
[RFC1777] Yeong, W., Howes, T., and S. Kille, "Lightweight Directory
|
|||
|
Access Protocol", RFC 1777, March 1995.
|
|||
|
|
|||
|
[RFC1960] T. Howes, "A String Representation of LDAP Search Filters",
|
|||
|
RFC 1960, June 1996.
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
Zeilenga LDAP True/False Filters [Page 3]
|
|||
|
|
|||
|
INTERNET-DRAFT draft-zeilenga-ldap-t-f-02.txt 17 May 2002
|
|||
|
|
|||
|
|
|||
|
[X.500] ITU-T Rec. X.500, "The Directory: Overview of Concepts,
|
|||
|
Models and Service", 1993.
|
|||
|
|
|||
|
[X.511] ITU-T Rec. X.511, "The Directory: Abstract Service
|
|||
|
Definition", 1993.
|
|||
|
|
|||
|
[ASSIGN] OpenLDAP Foundation, "OpenLDAP OID Delegations",
|
|||
|
http://www.openldap.org/foundation/oid-delegate.txt.
|
|||
|
|
|||
|
[PRIVATE] IANA, "Private Enterprise Numbers",
|
|||
|
http://www.iana.org/assignments/enterprise-numbers.
|
|||
|
|
|||
|
|
|||
|
|
|||
|
Copyright 2002, The Internet Society. All Rights Reserved.
|
|||
|
|
|||
|
This document and translations of it may be copied and furnished to
|
|||
|
others, and derivative works that comment on or otherwise explain it
|
|||
|
or assist in its implementation may be prepared, copied, published and
|
|||
|
distributed, in whole or in part, without restriction of any kind,
|
|||
|
provided that the above copyright notice and this paragraph are
|
|||
|
included on all such copies and derivative works. However, this
|
|||
|
document itself may not be modified in any way, such as by removing
|
|||
|
the copyright notice or references to the Internet Society or other
|
|||
|
Internet organizations, except as needed for the purpose of
|
|||
|
developing Internet standards in which case the procedures for
|
|||
|
copyrights defined in the Internet Standards process must be followed,
|
|||
|
or as required to translate it into languages other than English.
|
|||
|
|
|||
|
The limited permissions granted above are perpetual and will not be
|
|||
|
revoked by the Internet Society or its successors or assigns.
|
|||
|
|
|||
|
This document and the information contained herein is provided on an
|
|||
|
"AS IS" basis and THE AUTHORS, THE INTERNET SOCIETY, AND THE INTERNET
|
|||
|
ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED,
|
|||
|
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
|
|||
|
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
|
|||
|
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
|
|||
|
Zeilenga LDAP True/False Filters [Page 4]
|
|||
|
|