Home | History | Annotate | Line # | Download | only in schema 
      1 # dyngroup.schema -- Dynamic Group schema
      2 # $OpenLDAP$
      3 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
      4 ##
      5 ## Copyright 1998-2024 The OpenLDAP Foundation.
      6 ## All rights reserved.
      7 ##
      8 ## Redistribution and use in source and binary forms, with or without
      9 ## modification, are permitted only as authorized by the OpenLDAP
     10 ## Public License.
     11 ##
     12 ## A copy of this license is available in the file LICENSE in the
     13 ## top-level directory of the distribution or, alternatively, at
     14 ## <http://www.OpenLDAP.org/license.html>.
     15 #
     16 # Dynamic Group schema (experimental), as defined by Netscape.  See
     17 # http://www.redhat.com/docs/manuals/ent-server/pdf/esadmin611.pdf
     18 # page 70 for details on how these groups were used.
     19 #
     20 # A description of the objectclass definition is available here:
     21 # http://www.redhat.com/docs/manuals/dir-server/schema/7.1/oc_dir.html#1303745
     22 #
     23 # depends upon:
     24 #       core.schema
     25 #
     26 # These definitions are considered experimental due to the lack of
     27 # a formal specification (e.g., RFC).
     28 #
     29 # NOT RECOMMENDED FOR PRODUCTION USE!  USE WITH CAUTION!
     30 #
     31 # The Netscape documentation describes this as an auxiliary objectclass
     32 # but their implementations have always defined it as a structural class.
     33 # The sloppiness here is because Netscape-derived servers don't actually
     34 # implement the X.500 data model, and they don't honor the distinction
     35 # between structural and auxiliary classes. This fact is noted here:
     36 # http://forum.java.sun.com/thread.jspa?threadID=5016864&messageID=9034636
     37 #
     38 # In accordance with other existing implementations, we define it as a
     39 # structural class.
     40 #
     41 # Our definition of memberURL also does not match theirs but again
     42 # their published definition and what works in practice do not agree.
     43 # In other words, the Netscape definitions are broken and interoperability
     44 # is not guaranteed.
     45 #
     46 # Also see the new DynGroup proposed spec at
     47 # http://tools.ietf.org/html/draft-haripriya-dynamicgroup-02
     48 dn: cn=dyngroup,cn=schema,cn=config
     49 objectClass: olcSchemaConfig
     50 cn: dyngroup
     51 olcObjectIdentifier: {0}NetscapeRoot 2.16.840.1.113730
     52 olcObjectIdentifier: {1}NetscapeLDAP NetscapeRoot:3
     53 olcObjectIdentifier: {2}NetscapeLDAPattributeType NetscapeLDAP:1
     54 olcObjectIdentifier: {3}NetscapeLDAPobjectClass NetscapeLDAP:2
     55 olcObjectIdentifier: {4}OpenLDAPExp11 1.3.6.1.4.1.4203.666.11
     56 olcObjectIdentifier: {5}DynGroupBase OpenLDAPExp11:8
     57 olcObjectIdentifier: {6}DynGroupAttr DynGroupBase:1
     58 olcObjectIdentifier: {7}DynGroupOC DynGroupBase:2
     59 olcAttributeTypes: {0}( NetscapeLDAPattributeType:198 NAME 'memberURL' DESC 'I
     60  dentifies an URL associated with each member of a group. Any type of labeled 
     61  URL can be used.' SUP labeledURI )
     62 olcAttributeTypes: {1}( DynGroupAttr:1 NAME 'dgIdentity' DESC 'Identity to use
     63   when processing the memberURL' SUP distinguishedName SINGLE-VALUE )
     64 olcAttributeTypes: {2}( DynGroupAttr:2 NAME 'dgAuthz' DESC 'Optional authoriza
     65  tion rules that determine who is allowed to assume the dgIdentity' EQUALITY a
     66  uthzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 X-ORDERED 'VALUES' )
     67 olcAttributeTypes: {3}( DynGroupAttr:3 NAME 'dgMemberOf' DESC 'Group that the
     68  entry belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115
     69  .121.1.12 )
     70 olcObjectClasses: {0}( NetscapeLDAPobjectClass:33 NAME 'groupOfURLs' SUP top S
     71  TRUCTURAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $
     72   owner $ seeAlso ) )
     73 olcObjectClasses: {1}( DynGroupOC:1 NAME 'dgIdentityAux' SUP top AUXILIARY MAY
     74   ( dgIdentity $ dgAuthz ) )
     75