Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules
obsoletes
- rfc-2252 — Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions
- rfc-2256 — A Summary of the X.500(96) User Schema for use with LDAPv3
updates
- rfc-3698 — Lightweight Directory Access Protocol (LDAP): Additional Matching Rules
Extracted elements (31)
An AssertionValue in a SubstringFilter conforms to the assertion syntax of the equality matching rule for the attribute type, not the substrings matching rule. Conceptually, the entire SubstringFilter is converted into an assertion value of the substrings matching rule prior to applying the rule.
Matching rule definitions should not be changed after publication. If a change is desirable, a new matching rule with a different OID should be defined instead, ensuring stable semantics permanently tied to the original identifier.
The Guide syntax (OID 1.3.6.1.4.1.1466.115.121.1.25) is obsolete and should not be used for defining new attribute types; Enhanced Guide (Section 3.3.10, OID 1.3.6.1.4.1.1466.115.121.1.21) is its replacement and additionally permits specifying the recommended search depth.
UTC Time syntax (OID 1.3.6.1.4.1.1466.115.121.1.53) is deprecated in favor of Generalized Time because UTC Time uses only a two-digit year, creating century ambiguity. New attribute types should use Generalized Time.
A BER-encoded distinguished name (as used by X.500) re-encoded into the LDAP-specific string encoding is not necessarily reversible to the original BER encoding, because the chosen DirectoryString alternative (TeletexString, PrintableString, or UniversalString) is not indicated in the LDAP encoding.
When converting Directory String values between LDAP's UTF-8 encoding and X.500 BER encoding (which uses TeletexString, PrintableString, or UniversalString alternatives), conversions SHOULD be done consistently with the Transcode step of RFC 4518 string preparation algorithms.
Clients MUST NOT assume that the LDAP-specific encoding of a value of an unrecognized syntax is a human-readable character string. There are cases (e.g., the JPEG syntax) when it is not reasonable to produce a human-readable representation.
Directory String attribute type definitions should not restrict the format of Directory String values (e.g., by requiring conformance to specific ABNF patterns). A new syntax should be defined in such cases.
For Generalized Time, local time without a differential SHALL NOT be used. The 'Z' form of g-time-zone SHOULD be used in preference to g-differential. Character strings that do not represent valid calendar dates or times SHOULD be considered invalid.
Servers and clients MUST be prepared to receive arbitrary UCS code points in Directory String values, including code points outside printable ASCII and code points not presently assigned to any character.
Servers MUST publish, in the matchingRules attribute, the definitions of matching rules referenced by values of the attributeTypes and matchingRuleUse attributes in the same subschema entry. Other unreferenced matching rules MAY also be published.
Servers SHOULD implement all matching rules in Section 4.2 except wordMatch and keywordMatch (which servers MAY implement). Servers MAY implement additional matching rules beyond those listed.
Servers SHOULD recognize all the syntaxes listed in this document but are not required to otherwise support them, and MAY recognize or support other syntaxes. The definition of additional arbitrary syntaxes is discouraged since it will hinder interoperability; client and server implementations typically cannot dynamically recognize new syntaxes.
Servers that implement the extensibleMatch filter SHOULD allow the matching rules listed in Section 4.2 to be used in extensibleMatch and SHOULD allow matching rules to be used with all attribute types known to the server where the assertion syntax equals the value syntax.
bitStringMatch (OID 2.5.13.16) is an equality matching rule for BIT STRING values; evaluates TRUE if values have the same bit count and match bitwise. For syntaxes with a named bit list, trailing zero bits are treated as absent.
Boolean syntax encodes as the literal string 'TRUE' or 'FALSE'. OID: 1.3.6.1.4.1.1466.115.121.1.7. Corresponds to BOOLEAN ASN.1 type.
caseIgnoreMatch (OID 2.5.13.2) is an equality matching rule for DirectoryString and related syntaxes. Characters are case-folded in the Map step and only Insignificant Space Handling is applied. String preparation per RFC 4518 is required.
Country String syntax is exactly two PrintableCharacters drawn from ISO 3166 country codes. OID: 1.3.6.1.4.1.1466.115.121.1.11. Corresponds to PrintableString (SIZE(2)) ASN.1 type.
distinguishedNameMatch (OID 2.5.13.1) is an equality matching rule that evaluates TRUE if and only if the attribute and assertion DNs have the same number of RDNs and corresponding RDNs have equal AVAs (order of AVAs within an RDN is not significant).
DN syntax encodes a distinguished name per RFC 4514's <distinguishedName> rule. OID: 1.3.6.1.4.1.1466.115.121.1.12. Corresponds to DistinguishedName ASN.1 type from X.501.
generalizedTimeMatch (OID 2.5.13.27) evaluates TRUE if both values represent the same coordinated universal time; absent minutes or seconds are treated as zero. generalizedTimeOrderingMatch (OID 2.5.13.28) evaluates TRUE if the attribute value represents an earlier time than the assertion.
Name and Optional UID syntax encodes a distinguished name optionally followed by SHARP and a BitString (NameAndOptionalUID = distinguishedName [ SHARP BitString ]). OID: 1.3.6.1.4.1.1466.115.121.1.34.
objectIdentifierMatch (OID 2.5.13.0) is an equality matching rule that evaluates TRUE if assertion and attribute represent the same OID sequence. If a descriptor-form assertion value is not recognized by the server, the rule evaluates to Undefined.
This document registers LDAP syntaxes under OID arc 1.3.6.1.4.1.1466.115.121.1 and matching rules under OID arcs 2.5.13 and 1.3.6.1.4.1.1466.109.114 with IANA. A complete summary of syntax OIDs appears in Appendix A.
Security considerations for LDAP syntaxes and matching rules are addressed in the overall LDAP technical specification [RFC4510]. The LDAP-specific encoding of syntaxes always produces octet-aligned values, and clients must not make assumptions about the human-readability of values with unrecognized syntaxes.
Bit String is encoded as SQUOTE *binary-digit SQUOTE 'B' (e.g., '0101111101'B). OID: 1.3.6.1.4.1.1466.115.121.1.6. Corresponds to BIT STRING ASN.1 type.
Directory String is encoded as one or more UTF-8 characters (DirectoryString = 1*UTF8); zero-length strings are not permitted. OID: 1.3.6.1.4.1.1466.115.121.1.15.
Generalized Time is encoded as: century year month day hour [minute [second/leap-second]] [fraction] g-time-zone, where g-time-zone is 'Z' or a (+/-)hour[minute] differential. Fraction uses DOT or COMMA followed by digits. OID: 1.3.6.1.4.1.1466.115.121.1.24.
Integer syntax encodes a whole number of unlimited magnitude as an optionally signed decimal string (e.g., '1321'). Encoding: (HYPHEN LDIGIT *DIGIT) / number. OID: 1.3.6.1.4.1.1466.115.121.1.27.
Postal Address is encoded as dollar-sign-delimited UTF-8 lines (PostalAddress = line *(DOLLAR line)); '$' and '\' characters within lines are escaped as \24 and \5C respectively. OID: 1.3.6.1.4.1.1466.115.121.1.41.
Substring Assertion is encoded as [initial] ASTERISK*(substring ASTERISK) [final], where '*' and '\' within substrings are escaped as \2A and \5C. Used only as an assertion value in extensible match; not used as an attribute syntax or in SubstringFilter. OID: 1.3.6.1.4.1.1466.115.121.1.58.