1# dyngroup.schema -- Dynamic Group schema
2# $OpenLDAP$
3## This work is part of OpenLDAP Software <http://www.openldap.org/>.
4##
5## Copyright 1998-2021 The OpenLDAP Foundation.
6## All rights reserved.
7##
8## Redistribution and use in source and binary forms, with or without
9## modification, are permitted only as authorized by the OpenLDAP
10## Public License.
11##
12## A copy of this license is available in the file LICENSE in the
13## top-level directory of the distribution or, alternatively, at
14## <http://www.OpenLDAP.org/license.html>.
15#
16# Dynamic Group schema (experimental), as defined by Netscape.  See
17# http://www.redhat.com/docs/manuals/ent-server/pdf/esadmin611.pdf
18# page 70 for details on how these groups were used.
19#
20# A description of the objectclass definition is available here:
21# http://www.redhat.com/docs/manuals/dir-server/schema/7.1/oc_dir.html#1303745
22#
23# depends upon:
24#	core.schema
25#
26# These definitions are considered experimental due to the lack of
27# a formal specification (e.g., RFC).
28#
29# NOT RECOMMENDED FOR PRODUCTION USE!  USE WITH CAUTION!
30#
31# The Netscape documentation describes this as an auxiliary objectclass
32# but their implementations have always defined it as a structural class.
33# The sloppiness here is because Netscape-derived servers don't actually
34# implement the X.500 data model, and they don't honor the distinction
35# between structural and auxiliary classes. This fact is noted here:
36# http://forum.java.sun.com/thread.jspa?threadID=5016864&messageID=9034636
37#
38# In accordance with other existing implementations, we define it as a
39# structural class.
40#
41# Our definition of memberURL also does not match theirs but again
42# their published definition and what works in practice do not agree.
43# In other words, the Netscape definitions are broken and interoperability
44# is not guaranteed.
45#
46# Also see the new DynGroup proposed spec at
47# http://tools.ietf.org/html/draft-haripriya-dynamicgroup-02
48
49objectIdentifier NetscapeRoot 2.16.840.1.113730
50
51objectIdentifier NetscapeLDAP NetscapeRoot:3
52objectIdentifier NetscapeLDAPattributeType NetscapeLDAP:1
53objectIdentifier NetscapeLDAPobjectClass NetscapeLDAP:2
54
55objectIdentifier OpenLDAPExp11	1.3.6.1.4.1.4203.666.11
56objectIdentifier DynGroupBase	OpenLDAPExp11:8
57objectIdentifier DynGroupAttr	DynGroupBase:1
58objectIdentifier DynGroupOC	DynGroupBase:2
59
60attributetype ( NetscapeLDAPattributeType:198
61	NAME 'memberURL'
62	DESC 'Identifies an URL associated with each member of a group. Any type of labeled URL can be used.'
63	SUP labeledURI )
64
65attributetype ( DynGroupAttr:1
66	NAME 'dgIdentity'
67	DESC 'Identity to use when processing the memberURL'
68	SUP distinguishedName SINGLE-VALUE )
69
70attributeType ( DynGroupAttr:2
71	NAME 'dgAuthz'
72	DESC 'Optional authorization rules that determine who is allowed to assume the dgIdentity'
73	EQUALITY authzMatch
74	SYNTAX 1.3.6.1.4.1.4203.666.2.7
75	X-ORDERED 'VALUES' )
76
77# Just for testing. The actual memberOf is an operational attribute
78attributeType ( DynGroupAttr:3
79	NAME 'dgMemberOf'
80	DESC 'Group that the entry belongs to'
81	SYNTAX '1.3.6.1.4.1.1466.115.121.1.12'
82	EQUALITY distinguishedNameMatch )
83
84objectClass ( NetscapeLDAPobjectClass:33
85	NAME 'groupOfURLs'
86	SUP top STRUCTURAL
87	MUST cn
88	MAY ( memberURL $ businessCategory $ description $ o $ ou $
89		owner $ seeAlso ) )
90
91# The Haripriya dyngroup schema still needs a lot of work.
92# We're just adding support for the dgIdentity attribute for now...
93objectClass ( DynGroupOC:1
94	NAME 'dgIdentityAux'
95	SUP top AUXILIARY
96	MAY ( dgIdentity $ dgAuthz ) )
97
98
99