1# dyngroup.schema -- Dynamic Group schema 2# $OpenLDAP$ 3## This work is part of OpenLDAP Software <http://www.openldap.org/>. 4## 5## Copyright 1998-2021 The OpenLDAP Foundation. 6## All rights reserved. 7## 8## Redistribution and use in source and binary forms, with or without 9## modification, are permitted only as authorized by the OpenLDAP 10## Public License. 11## 12## A copy of this license is available in the file LICENSE in the 13## top-level directory of the distribution or, alternatively, at 14## <http://www.OpenLDAP.org/license.html>. 15# 16# Dynamic Group schema (experimental), as defined by Netscape. See 17# http://www.redhat.com/docs/manuals/ent-server/pdf/esadmin611.pdf 18# page 70 for details on how these groups were used. 19# 20# A description of the objectclass definition is available here: 21# http://www.redhat.com/docs/manuals/dir-server/schema/7.1/oc_dir.html#1303745 22# 23# depends upon: 24# core.schema 25# 26# These definitions are considered experimental due to the lack of 27# a formal specification (e.g., RFC). 28# 29# NOT RECOMMENDED FOR PRODUCTION USE! USE WITH CAUTION! 30# 31# The Netscape documentation describes this as an auxiliary objectclass 32# but their implementations have always defined it as a structural class. 33# The sloppiness here is because Netscape-derived servers don't actually 34# implement the X.500 data model, and they don't honor the distinction 35# between structural and auxiliary classes. This fact is noted here: 36# http://forum.java.sun.com/thread.jspa?threadID=5016864&messageID=9034636 37# 38# In accordance with other existing implementations, we define it as a 39# structural class. 40# 41# Our definition of memberURL also does not match theirs but again 42# their published definition and what works in practice do not agree. 43# In other words, the Netscape definitions are broken and interoperability 44# is not guaranteed. 45# 46# Also see the new DynGroup proposed spec at 47# http://tools.ietf.org/html/draft-haripriya-dynamicgroup-02 48dn: cn=dyngroup,cn=schema,cn=config 49objectClass: olcSchemaConfig 50cn: dyngroup 51olcObjectIdentifier: {0}NetscapeRoot 2.16.840.1.113730 52olcObjectIdentifier: {1}NetscapeLDAP NetscapeRoot:3 53olcObjectIdentifier: {2}NetscapeLDAPattributeType NetscapeLDAP:1 54olcObjectIdentifier: {3}NetscapeLDAPobjectClass NetscapeLDAP:2 55olcObjectIdentifier: {4}OpenLDAPExp11 1.3.6.1.4.1.4203.666.11 56olcObjectIdentifier: {5}DynGroupBase OpenLDAPExp11:8 57olcObjectIdentifier: {6}DynGroupAttr DynGroupBase:1 58olcObjectIdentifier: {7}DynGroupOC DynGroupBase:2 59olcAttributeTypes: {0}( NetscapeLDAPattributeType:198 NAME 'memberURL' DESC 'I 60 dentifies an URL associated with each member of a group. Any type of labeled 61 URL can be used.' SUP labeledURI ) 62olcAttributeTypes: {1}( DynGroupAttr:1 NAME 'dgIdentity' DESC 'Identity to use 63 when processing the memberURL' SUP distinguishedName SINGLE-VALUE ) 64olcAttributeTypes: {2}( DynGroupAttr:2 NAME 'dgAuthz' DESC 'Optional authoriza 65 tion rules that determine who is allowed to assume the dgIdentity' EQUALITY a 66 uthzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 X-ORDERED 'VALUES' ) 67olcAttributeTypes: {3}( DynGroupAttr:3 NAME 'dgMemberOf' DESC 'Group that the 68 entry belongs to' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115 69 .121.1.12 ) 70olcObjectClasses: {0}( NetscapeLDAPobjectClass:33 NAME 'groupOfURLs' SUP top S 71 TRUCTURAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $ 72 owner $ seeAlso ) ) 73olcObjectClasses: {1}( DynGroupOC:1 NAME 'dgIdentityAux' SUP top AUXILIARY MAY 74 ( dgIdentity $ dgAuthz ) ) 75