Lightweight Directory Access Protocol (LDAP): Additional Matching Rules
updated by
- rfc-4517 — Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules
updates
- rfc-2798 — Definition of the inetOrgPerson LDAP Object Class
Extracted elements (17)
These matching rules are simple adaptations of X.500 Directory matching rules from X.520, most already in wide use on the Internet, including in support of inetOrgPerson (RFC 2798) and Policy Core Information Model (RFC 3703) LDAP schemas.
This document supersedes the informational matching rule descriptions provided in RFC 2798 section 9.3.3, elevating them to Standards Track; implementors should reference this document rather than RFC 2798 for these rules.
The caseIgnoreListSubstringsMatch rule requires that no initial, any, or final component of the asserted SubstringsAssertion value matches a substring that spans more than one stored DirectoryString component of the list, constraining interoperability with implementations that naively concatenate and match.
The booleanMatch rule (OID 2.5.13.13) compares for equality an asserted Boolean value with an attribute value of BOOLEAN syntax, returning TRUE if and only if both values are TRUE or both are FALSE.
The caseExactMatch rule (OID 2.5.13.5) compares for equality the asserted value with an attribute value of DirectoryString syntax, identical to caseIgnoreMatch except that case is not ignored.
The caseExactOrderingMatch rule (OID 2.5.13.6) compares the collation order of the asserted string with an attribute value of DirectoryString syntax, identical to caseIgnoreOrderingMatch except that letters are not folded.
The caseExactSubstringsMatch rule (OID 2.5.13.7) determines whether asserted value(s) are substrings of an attribute value of DirectoryString syntax, identical to caseIgnoreSubstringsMatch except that case is not ignored.
The caseIgnoreListSubstringsMatch rule (OID 2.5.13.12) compares the asserted substring with an attribute value that is a sequence of DirectoryStrings by matching against the concatenated string, with the constraint that no asserted substring component may span more than one stored string component.
The directoryStringFirstComponentMatch rule (OID 2.5.13.31) compares for equality an asserted DirectoryString value with the first component of a SEQUENCE-typed attribute value, using caseIgnoreMatch semantics for the comparison.
The integerOrderingMatch rule (OID 2.5.13.15) compares the ordering of the asserted integer with an attribute value of INTEGER syntax, returning TRUE if the attribute value is less than the asserted value.
The keywordMatch rule (OID 2.5.13.33) compares the asserted string with keywords in an attribute value of DirectoryString syntax, returning TRUE if the asserted value matches any keyword; identification of keywords and exactness of match are implementation specific.
The numericStringOrderingMatch rule (OID 2.5.13.9) compares the collation order of the asserted string with an attribute value of NumericString syntax, skipping all space characters during comparison.
The octetStringOrderingMatch rule (OID 2.5.13.18) compares octet strings bit-by-bit from first to last octet, most to least significant bit, with zero bits preceding one bits and shorter strings preceding longer identical strings.
The storedPrefixMatch rule (OID 2.5.13.41) returns TRUE if and only if the attribute value of DirectoryString syntax is an initial substring (prefix) of the asserted value, case-insensitively; useful for matching telephone area codes against full telephone numbers.
The wordMatch rule (OID 2.5.13.32) compares the asserted string with words in a DirectoryString attribute value using caseIgnoreMatch semantics per word; the definition of a 'word' is implementation specific.
IANA updated the LDAP descriptors registry (per RFC 3383) to add 12 matching rule descriptors: booleanMatch (2.5.13.13), caseExactMatch (2.5.13.5), caseExactOrderingMatch (2.5.13.6), caseExactSubstringsMatch (2.5.13.7), caseIgnoreListSubstringsMatch (2.5.13.12), directoryStringFirstComponentMatch (2.5.13.31), integerOrderingMatch (2.5.13.15), keywordMatch (2.5.13.33), numericStringOrderingMatch (2.5.13.9), octetStringOrderingMatch (2.5.13.18), storedPrefixMatch (2.5.13.41), wordMatch (2.5.13.32). No new OIDs are assigned; only LDAP descriptions are associated with existing X.500 OIDs.
General LDAP security considerations from RFC 3377 apply to the use of this schema; no additional security considerations specific to these matching rules are introduced beyond those noted inline.