Collective Attributes in the Lightweight Directory Access Protocol (LDAP)
RFC 3671

Document Type RFC - Proposed Standard (December 2003; No errata)
Was draft-zeilenga-ldap-collective (individual in app area)
Author Kurt Zeilenga 
Last updated 2018-07-18
Stream IETF
Formats plain text html pdf htmlized bibtex
Stream WG state (None)
Document shepherd No shepherd assigned
IESG IESG state RFC 3671 (Proposed Standard)
Consensus Boilerplate Unknown
Telechat date
Responsible AD Ted Hardie
IESG note New versions exists which is verified with IESG
Responsible: Patrik
Send notices to (None)
Network Working Group                                        K. Zeilenga
Request for Comments: 3671                           OpenLDAP Foundation
Category: Standards Track                                  December 2003

                        Collective Attributes in
            the Lightweight Directory Access Protocol (LDAP)

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.


   X.500 collective attributes allow common characteristics to be shared
   between collections of entries.  This document summarizes the X.500
   information model for collective attributes and describes use of
   collective attributes in LDAP (Lightweight Directory Access
   Protocol).  This document provides schema definitions for collective
   attributes for use in LDAP.

1.  Introduction

   In X.500 [X.500], a collective attribute is "a user attribute whose
   values are the same for each member of an entry collection" [X.501].
   This document details their use in the Lightweight Directory Access
   Protocol (LDAP) [RFC3377].

1.1.  Entry Collections

   A collection of entries is a grouping of object and alias entries
   based upon common properties or shared relationship between the
   corresponding entries which share certain attributes.  An entry
   collection consists of all entries within scope of a collective
   attributes subentry [RFC3672].  An entry can belong to several entry

Zeilenga                    Standards Track                     [Page 1]
RFC 3671             Collective Attributes in LDAP         December 2003

1.2.  Collective Attributes

   Attributes shared by the entries comprising an entry collection are
   called collective attributes.  Values of collective attributes are
   visible but not updateable to clients accessing entries within the
   collection.  Collective attributes are updated (i.e., modified) via
   their associated collective attributes subentry.

   When an entry belongs to multiple entry collections, the entry's
   values of each collective attribute are combined such that
   independent sources of these values are not manifested to clients.

   Entries can specifically exclude a particular collective attribute by
   listing the attribute as a value of the collectiveExclusions
   attribute.  Like other user attributes, collective attributes are
   subject to a variety of controls including access, administrative,
   and content controls.

1.3.  Conventions

   Schema definitions are provided using LDAPv3 [RFC2251] description
   formats [RFC2252].  Definitions provided here are formatted (line
   wrapped) for readability.

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   document are to be interpreted as described in BCP 14 [RFC2119].

2.  System Schema for Collective Attributes

   The following operational attributes are used to manage Collective
   Attributes.  LDAP servers [RFC3377] MUST act in accordance with the
   X.500 Directory Models [X.501] when providing this service.

2.1.  collectiveAttributeSubentry

   Subentries of this object class are used to administer collective
   attributes and are referred to as collective attribute subentries.

      ( NAME 'collectiveAttributeSubentry' AUXILIARY )

   A collective attribute subentry SHOULD contain at least one
   collective attribute.  The collective attributes contained within a
   collective attribute subentry are available for finding, searching,
   and comparison at every entry within the scope of the subentry.  The
   collective attributes, however, are administered (e.g., modified) via
   the subentry.

Zeilenga                    Standards Track                     [Page 2]
RFC 3671             Collective Attributes in LDAP         December 2003

   Implementations of this specification SHOULD support collective
   attribute subentries in both collectiveAttributeSpecificArea
   ( and collectiveAttributeInnerArea ( administrative
   areas [RFC3672][X.501].

2.2.  collectiveAttributeSubentries

   The collectiveAttributeSubentries operational attribute identifies
   all collective attribute subentries that affect the entry.

      ( NAME 'collectiveAttributeSubentries'
        EQUALITY distinguishedNameMatch
        USAGE directoryOperation NO-USER-MODIFICATION )

2.3.  collectiveExclusions

   The collectiveExclusions operational attribute allows particular
   collective attributes to be excluded from an entry.  It MAY appear in
Show full document text