.B slapd
 server's command line options
 if started without the debugging command line option.
+.TP
+.B attributeoptions [option-name]...
+Define tagging attribute options or option tag/range prefixes.
+Options must not end with `-', prefixes must end with `-'.
+The `lang-' prefix is predefined.
+If you use the
+.B attributeoptions
+directive, `lang-' will no longer be defined and you must specify it
+explicitly if you want it defined.
+
+An attribute description with a tagging option is a subtype of that
+attribute description without the option.
+Except for that, options defined this way have no special semantics.
+Prefixes defined this way work like the `lang-' options:
+They define a prefix for tagging options starting with the prefix.
+That is, if you define the prefix `x-foo-', you can use the option
+`x-foo-bar'.
+Furthermore, in a search or compare, a prefix or range name (with
+a trailing `-') matches all options starting with that name, as well
+as the option with the range name sans the trailing `-'.
+That is, `x-foo-bar-' matches `x-foo-bar' and `x-foo-bar-baz'.
+
+RFC2251 reserves options beginning with `x-' for private experiments.
+Other options should be registered with IANA, see RFC3383 section 3.4.
+OpenLDAP also has the `binary' option built in, but this is a transfer
+option, not a tagging option.
 .HP
 .hy 0
 .B attributetype "(\ <oid> [NAME\ <name>] [OBSOLETE]\
 include   SYSCONFDIR/schema/core.schema
 pidfile   LOCALSTATEDIR/slapd.pid
 
+# Subtypes of "name" (e.g. "cn" and "ou") with the
+# option ";x-hidden" can be searched for/compared,
+# but are not shown.  See \fBslapd.access\fP(5).
+attributeoptions x-hidden lang-
+access to attr=name;x-hidden by * =cs
+
 database  bdb
 suffix    "dc=our-domain,dc=com"
 # The database directory MUST exist prior to
 
 #include "ldap_pvt.h"
 #include "slap.h"
 
+typedef struct Attr_option {
+       struct berval name;     /* option name or prefix */
+       int           prefix;   /* NAME is a tag and range prefix */
+} Attr_option;
+
+static Attr_option lang_option = { { sizeof("lang-")-1, "lang-" }, 1 };
+
+/* Options sorted by name, and number of options */
+static Attr_option *options = &lang_option;
+static int option_count = 1;
+
+static Attr_option *ad_find_option_definition( const char *opt, int optlen );
+
 static int ad_keystring(
        struct berval *bv )
 {
                        desc.ad_flags |= SLAP_DESC_BINARY;
                        continue;
 
-               } else if ( optlen >= sizeof("lang-")-1 &&
-                       strncasecmp( opt, "lang-", sizeof("lang-")-1 ) == 0 )
+               } else if ( ad_find_option_definition( opt, optlen ) )
                {
                        int i;
 
                        }
 
                        if( nlang >= MAX_LANG_OPTIONS ) {
-                               *text = "too many language options";
+                               *text = "too many tagging options";
                                return rtn;
                        }
 
                int i;
 
                if( langlen > MAX_LANG_LEN ) {
-                       *text = "language options too long";
+                       *text = "tagging options too long";
                        return rtn;
                }
 
                /* Allocate a single contiguous block. If there are no
                 * options, we just need space for the AttrDesc structure.
                 * Otherwise, we need to tack on the full name length +
-                * options length.
+                * options length, + maybe language options length again.
                 */
                if (desc.ad_lang.bv_len || desc.ad_flags != SLAP_DESC_NONE) {
-                       dlen = desc.ad_type->sat_cname.bv_len;
+                       dlen = desc.ad_type->sat_cname.bv_len + 1;
                        if (desc.ad_lang.bv_len) {
                                dlen += 1+desc.ad_lang.bv_len;
                        }
                        if( slap_ad_is_binary( &desc ) ) {
-                               dlen += sizeof(";binary")-1;
+                               dlen += sizeof(";binary")+desc.ad_lang.bv_len;
                        }
                }
 
-               d2 = ch_malloc(sizeof(AttributeDescription) + dlen + 1);
+               d2 = ch_malloc(sizeof(AttributeDescription) + dlen);
                d2->ad_type = desc.ad_type;
                d2->ad_flags = desc.ad_flags;
                d2->ad_cname.bv_len = desc.ad_type->sat_cname.bv_len;
                        d2->ad_cname.bv_val = d2->ad_type->sat_cname.bv_val;
                        d2->ad_lang.bv_val = NULL;
                } else {
+                       char *cp, *op, *lp;
+                       int j;
                        d2->ad_cname.bv_val = (char *)(d2+1);
                        strcpy(d2->ad_cname.bv_val, d2->ad_type->sat_cname.bv_val);
+                       cp = d2->ad_cname.bv_val + d2->ad_cname.bv_len;
                        if( slap_ad_is_binary( &desc ) ) {
-                               strcpy(d2->ad_cname.bv_val+d2->ad_cname.bv_len,
-                                       ";binary");
-                               d2->ad_cname.bv_len += sizeof(";binary")-1;
+                               op = cp;
+                               lp = NULL;
+                               if( desc.ad_lang.bv_len ) {
+                                       lp = desc.ad_lang.bv_val;
+                                       while( strncasecmp(lp, "binary", sizeof("binary")-1) < 0
+                                              && (lp = strchr( lp, ';' )) != NULL )
+                                               ++lp;
+                                       if( lp != desc.ad_lang.bv_val ) {
+                                               *cp++ = ';';
+                                               j = (lp
+                                                    ? lp - desc.ad_lang.bv_val - 1
+                                                    : strlen( desc.ad_lang.bv_val ));
+                                               strncpy(cp, desc.ad_lang.bv_val, j);
+                                               cp += j;
+                                       }
+                               }
+                               strcpy(cp, ";binary");
+                               cp += sizeof(";binary")-1;
+                               if( lp != NULL ) {
+                                       *cp++ = ';';
+                                       strcpy(cp, lp);
+                                       cp += strlen( cp );
+                               }
+                               d2->ad_cname.bv_len = cp - d2->ad_cname.bv_val;
+                               if( desc.ad_lang.bv_len )
+                                       ldap_pvt_str2lower(op);
+                               j = 1;
+                       } else {
+                               j = 0;
                        }
-                       if( d2->ad_lang.bv_len ) {
-                               d2->ad_cname.bv_val[d2->ad_cname.bv_len++]=';';
-                               d2->ad_lang.bv_val = d2->ad_cname.bv_val+
-                                       d2->ad_cname.bv_len;
-                               strncpy(d2->ad_lang.bv_val,desc.ad_lang.bv_val,
-                                       d2->ad_lang.bv_len);
-                               d2->ad_lang.bv_val[d2->ad_lang.bv_len] = '\0';
-                               ldap_pvt_str2lower(d2->ad_lang.bv_val);
-                               d2->ad_cname.bv_len += d2->ad_lang.bv_len;
+                       if( desc.ad_lang.bv_len ) {
+                               lp = d2->ad_cname.bv_val + d2->ad_cname.bv_len + j;
+                               if ( j == 0 )
+                                       *lp++ = ';';
+                               d2->ad_lang.bv_val = lp;
+                               strcpy(lp, desc.ad_lang.bv_val);
+                               ldap_pvt_str2lower(lp);
+                               if( j == 0 )
+                                       d2->ad_cname.bv_len += 1 + desc.ad_lang.bv_len;
                        }
                }
                /* Add new desc to list. We always want the bare Desc with
        return( an );
 }
 
+
+/* Define an attribute option. */
+int
+ad_define_option( const char *name, const char *fname, int lineno )
+{
+       int i, j, len, optlen;
+
+       if ( options == &lang_option ) {
+               options = NULL;
+               option_count = 0;
+       }
+       if ( name == NULL )
+               return 0;
+
+       optlen = 0;
+       do {
+               if ( !DESC_CHAR( name[optlen] ) ) {
+#ifdef NEW_LOGGING
+                       LDAP_LOG( CONFIG, CRIT,
+                                 "%s: line %d: illegal option name \"%s\"\n",
+                                 fname, lineno, name );
+#else
+                       Debug( LDAP_DEBUG_ANY,
+                              "%s: line %d: illegal option name \"%s\"\n",
+                                   fname, lineno, name );
+#endif
+                       return 1;
+               }
+       } while ( name[++optlen] );
+
+       options = ch_realloc( options,
+                             (option_count+1) * sizeof(Attr_option) );
+
+       if ( strcasecmp( name, "binary" ) == 0
+            || ad_find_option_definition( name, optlen ) ) {
+#ifdef NEW_LOGGING
+               LDAP_LOG( CONFIG, CRIT,
+                         "%s: line %d: option \"%s\" is already defined\n",
+                         fname, lineno, name );
+#else
+               Debug( LDAP_DEBUG_ANY,
+                      "%s: line %d: option \"%s\" is already defined\n",
+                      fname, lineno, name );
+#endif
+               return 1;
+       }
+
+       for ( i = option_count; i; --i ) {
+               if ( strcasecmp( name, options[i-1].name.bv_val ) >= 0 )
+                       break;
+               options[i] = options[i-1];
+       }
+
+       options[i].name.bv_val = ch_strdup( name );
+       options[i].name.bv_len = optlen;
+       options[i].prefix = (name[optlen-1] == '-');
+
+       if ( i != option_count &&
+            options[i].prefix &&
+            optlen < options[i+1].name.bv_len &&
+            strncasecmp( name, options[i+1].name.bv_val, optlen ) == 0 ) {
+#ifdef NEW_LOGGING
+                       LDAP_LOG( CONFIG, CRIT,
+                                 "%s: line %d: option \"%s\" overrides previous option\n",
+                                 fname, lineno, name );
+#else
+                       Debug( LDAP_DEBUG_ANY,
+                              "%s: line %d: option \"%s\" overrides previous option\n",
+                                   fname, lineno, name );
+#endif
+                       return 1;
+       }
+
+       option_count++;
+       return 0;
+}
+
+/* Find the definition of the option name or prefix matching the arguments */
+static Attr_option *
+ad_find_option_definition( const char *opt, int optlen )
+{
+       int top = 0, bot = option_count;
+       while ( top < bot ) {
+               int mid = (top + bot) / 2;
+               int mlen = options[mid].name.bv_len;
+               char *mname = options[mid].name.bv_val;
+               int j;
+               if ( optlen < mlen ) {
+                       j = strncasecmp( opt, mname, optlen ) - 1;
+               } else {
+                       j = strncasecmp( opt, mname, mlen );
+                       if ( j==0 && (optlen==mlen || options[mid].prefix) )
+                               return &options[mid];
+               }
+               if ( j < 0 )
+                       bot = mid;
+               else
+                       top = mid + 1;
+       }
+       return NULL;
+}