7 INTERNET-DRAFT Kurt D. Zeilenga
8 Intended Category: Standard Track OpenLDAP Foundation
9 Expires in six months 25 October 2003
13 LDAP Absolute True and False Filters
14 <draft-zeilenga-ldap-t-f-07.txt>
19 This document is an Internet-Draft and is in full conformance with all
20 provisions of Section 10 of RFC2026.
22 This document is intended to be, after appropriate review and
23 revision, submitted to the RFC Editor as a Standard Track document.
24 Distribution of this memo is unlimited. Technical discussion of this
25 document will take place on the IETF LDAP Extensions mailing list
26 <ldapext@ietf.org>. Please send editorial comments directly to the
27 author <Kurt@OpenLDAP.org>.
29 Internet-Drafts are working documents of the Internet Engineering Task
30 Force (IETF), its areas, and its working groups. Note that other
31 groups may also distribute working documents as Internet-Drafts.
32 Internet-Drafts are draft documents valid for a maximum of six months
33 and may be updated, replaced, or obsoleted by other documents at any
34 time. It is inappropriate to use Internet-Drafts as reference
35 material or to cite them other than as ``work in progress.''
37 The list of current Internet-Drafts can be accessed at
38 <http://www.ietf.org/ietf/1id-abstracts.txt>. The list of
39 Internet-Draft Shadow Directories can be accessed at
40 <http://www.ietf.org/shadow.html>.
42 Copyright (C) The Internet Society (2003). All Rights Reserved.
44 Please see the Full Copyright section near the end of this document
50 This document extends the Lightweight Directory Access Protocol (LDAP)
51 to support absolute True and False filters based upon similar
52 capabilities found in X.500 directory systems. The document also
53 extends the String Representation of LDAP Search Filters to support
58 Zeilenga LDAP True & False Filters [Page 1]
60 INTERNET-DRAFT draft-zeilenga-ldap-t-f-07.txt 25 October 2003
65 The X.500 Directory Access Protocol (DAP) [X.511] supports absolute
66 True and False assertions. An 'and' filter with zero elements always
67 evaluates to True. An 'or' filter with zero elements always evaluates
68 to False. These filters are commonly used when requesting DSA-
69 specific Entries (DSEs) which do not necessarily have 'objectClass'
70 attributes. That is, where "(objectClass=*)" may evaluate to False.
72 While LDAPv2 [RFC1777][RFC3494] placed no restriction on the number of
73 elements in 'and' and 'or' filter sets, the LDAPv2 string
74 representation [RFC1960] could not represent empty 'and' and 'or'
75 filter sets. Due to this, absolute True or False filters were
76 (unfortunately) eliminated from LDAPv3 [RFC3377].
78 This documents extends LDAPv3 to support absolute True and False
79 matches by allowing empty 'and' and 'or' in Search filters [RFC2251]
80 and extends the filter string representation [RFC2254] to allow empty
83 This feature is intended to allow a more direct mapping between DAP
84 and LDAP (as needed to implement DAP-to-LDAP gateways).
87 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
88 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
89 document are to be interpreted as described in BCP 14 [RFC2119].
92 2. Absolute True and False Filters
94 Implementations of this extension SHALL allow 'and' and 'or' choices
95 with zero filter elements.
97 An 'and' filter consisting of an empty set of filters SHALL evaluate
98 to True. This filter is represented by the string "(&)".
100 An 'or' filter consisting of an empty set of filters SHALL evaluate to
101 False. This filter is represented by the string "(|)".
103 Servers supporting this feature SHOULD publish the Object Identifier
104 (OID) 1.3.6.1.4.1.4203.1.5.3 as a value of the 'supportedFeatures'
105 [FEATURES] attribute in the root DSE.
107 Clients supporting this feature SHOULD NOT use the feature unless they
108 have knowledge the server supports it.
114 Zeilenga LDAP True & False Filters [Page 2]
116 INTERNET-DRAFT draft-zeilenga-ldap-t-f-07.txt 25 October 2003
119 3. Security Considerations
121 The (re)introduction of absolute True and False filters is not
122 believed to raise any new security considerations.
124 Implementors of this (or any) LDAPv3 extension should be familiar with
125 general LDAPv3 security considerations [RFC3377].
128 4. IANA Considerations
130 The OID 1.3.6.1.4.1.4203.1.5.3 identifies the feature described above.
131 This OID was assigned [ASSIGN] by OpenLDAP Foundation, under its
132 IANA-assigned private enterprise allocation [PRIVATE], for use in this
135 Registration of this feature is requested [FEATURES][RFC3383].
137 Subject: Request for LDAP Protocol Mechanism Registration
138 Object Identifier: 1.3.6.1.4.1.4203.1.5.3
139 Description: T/F Filters
140 Person & email address to contact for further information:
141 Kurt Zeilenga <kurt@openldap.org>
143 Specification: RFC XXXX
144 Author/Change Controller: IESG
155 6. Normative References
157 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
158 Requirement Levels", BCP 14 (also RFC 2119), March 1997.
160 [RFC2251] Wahl, M., T. Howes and S. Kille, "Lightweight Directory
161 Access Protocol (v3)", RFC 2251, December 1997.
163 [RFC2254] Howes, T., "A String Representation of LDAP Search
164 Filters", RFC 2254, December 1997.
166 [RFC3377] Hodges, J. and R. Morgan, "Lightweight Directory Access
170 Zeilenga LDAP True & False Filters [Page 3]
172 INTERNET-DRAFT draft-zeilenga-ldap-t-f-07.txt 25 October 2003
175 Protocol (v3): Technical Specification", RFC 3377,
178 [FEATURES] Zeilenga, K., "Feature Discovery in LDAP",
179 draft-zeilenga-ldap-features-xx.txt, a work in progress.
182 7. Informative References
184 [RFC1777] Yeong, W., Howes, T., and S. Kille, "Lightweight
185 Directory Access Protocol", RFC 1777, March 1995.
187 [RFC1960] Howes, T., "A String Representation of LDAP Search
188 Filters", RFC 1960, June 1996.
190 [RFC3383] Zeilenga, K., "IANA Considerations for LDAP", BCP 64
191 (also RFC 3383), September 2002.
193 [RFC3494] Zeilenga, K., "Lightweight Directory Access Protocol
194 version 2 (LDAPv2) to Historic Status", RFC 3494, March
197 [X.500] International Telecommunication Union -
198 Telecommunication Standardization Sector, "The Directory
199 -- Overview of concepts, models and services,"
200 X.500(1993) (also ISO/IEC 9594-1:1994).
202 [X.501] International Telecommunication Union -
203 Telecommunication Standardization Sector, "The Directory
204 -- Models," X.501(1993) (also ISO/IEC 9594-2:1994).
206 [ASSIGN] OpenLDAP Foundation, "OpenLDAP OID Delegations",
207 http://www.openldap.org/foundation/oid-delegate.txt.
209 [PRIVATE] IANA, "Private Enterprise Numbers",
210 http://www.iana.org/assignments/enterprise-numbers.
214 Intellectual Property Rights
216 The IETF takes no position regarding the validity or scope of any
217 intellectual property or other rights that might be claimed to pertain
218 to the implementation or use of the technology described in this
219 document or the extent to which any license under such rights might or
220 might not be available; neither does it represent that it has made any
221 effort to identify any such rights. Information on the IETF's
222 procedures with respect to rights in standards-track and
226 Zeilenga LDAP True & False Filters [Page 4]
228 INTERNET-DRAFT draft-zeilenga-ldap-t-f-07.txt 25 October 2003
231 standards-related documentation can be found in BCP-11. Copies of
232 claims of rights made available for publication and any assurances of
233 licenses to be made available, or the result of an attempt made to
234 obtain a general license or permission for the use of such proprietary
235 rights by implementors or users of this specification can be obtained
236 from the IETF Secretariat.
238 The IETF invites any interested party to bring to its attention any
239 copyrights, patents or patent applications, or other proprietary
240 rights which may cover technology that may be required to practice
241 this standard. Please address the information to the IETF Executive
248 Copyright (C) The Internet Society (2003). All Rights Reserved.
250 This document and translations of it may be copied and furnished to
251 others, and derivative works that comment on or otherwise explain it
252 or assist in its implmentation may be prepared, copied, published and
253 distributed, in whole or in part, without restriction of any kind,
254 provided that the above copyright notice and this paragraph are
255 included on all such copies and derivative works. However, this
256 document itself may not be modified in any way, such as by removing
257 the copyright notice or references to the Internet Society or other
258 Internet organizations, except as needed for the purpose of
259 developing Internet standards in which case the procedures for
260 copyrights defined in the Internet Standards process must be followed,
261 or as required to translate it into languages other than English.
282 Zeilenga LDAP True & False Filters [Page 5]