| 9 |
- |
1 |
# dyngroup.schema -- Dynamic Group schema
|
|
|
2 |
# $OpenLDAP$
|
|
|
3 |
## This work is part of OpenLDAP Software <http://www.openldap.org/>.
|
|
|
4 |
##
|
|
|
5 |
## Copyright 1998-2014 The OpenLDAP Foundation.
|
|
|
6 |
## All rights reserved.
|
|
|
7 |
##
|
|
|
8 |
## Redistribution and use in source and binary forms, with or without
|
|
|
9 |
## modification, are permitted only as authorized by the OpenLDAP
|
|
|
10 |
## Public License.
|
|
|
11 |
##
|
|
|
12 |
## A copy of this license is available in the file LICENSE in the
|
|
|
13 |
## top-level directory of the distribution or, alternatively, at
|
|
|
14 |
## <http://www.OpenLDAP.org/license.html>.
|
|
|
15 |
#
|
|
|
16 |
# Dynamic Group schema (experimental), as defined by Netscape. See
|
|
|
17 |
# http://www.redhat.com/docs/manuals/ent-server/pdf/esadmin611.pdf
|
|
|
18 |
# page 70 for details on how these groups were used.
|
|
|
19 |
#
|
|
|
20 |
# A description of the objectclass definition is available here:
|
|
|
21 |
# http://www.redhat.com/docs/manuals/dir-server/schema/7.1/oc_dir.html#1303745
|
|
|
22 |
#
|
|
|
23 |
# depends upon:
|
|
|
24 |
# core.schema
|
|
|
25 |
#
|
|
|
26 |
# These definitions are considered experimental due to the lack of
|
|
|
27 |
# a formal specification (e.g., RFC).
|
|
|
28 |
#
|
|
|
29 |
# NOT RECOMMENDED FOR PRODUCTION USE! USE WITH CAUTION!
|
|
|
30 |
#
|
|
|
31 |
# The Netscape documentation describes this as an auxiliary objectclass
|
|
|
32 |
# but their implementations have always defined it as a structural class.
|
|
|
33 |
# The sloppiness here is because Netscape-derived servers don't actually
|
|
|
34 |
# implement the X.500 data model, and they don't honor the distinction
|
|
|
35 |
# between structural and auxiliary classes. This fact is noted here:
|
|
|
36 |
# http://forum.java.sun.com/thread.jspa?threadID=5016864&messageID=9034636
|
|
|
37 |
#
|
|
|
38 |
# In accordance with other existing implementations, we define it as a
|
|
|
39 |
# structural class.
|
|
|
40 |
#
|
|
|
41 |
# Our definition of memberURL also does not match theirs but again
|
|
|
42 |
# their published definition and what works in practice do not agree.
|
|
|
43 |
# In other words, the Netscape definitions are broken and interoperability
|
|
|
44 |
# is not guaranteed.
|
|
|
45 |
#
|
|
|
46 |
# Also see the new DynGroup proposed spec at
|
|
|
47 |
# http://tools.ietf.org/html/draft-haripriya-dynamicgroup-02
|
|
|
48 |
dn: cn=dyngroup,cn=schema,cn=config
|
|
|
49 |
objectClass: olcSchemaConfig
|
|
|
50 |
cn: dyngroup
|
|
|
51 |
olcObjectIdentifier: {0}NetscapeRoot 2.16.840.1.113730
|
|
|
52 |
olcObjectIdentifier: {1}NetscapeLDAP NetscapeRoot:3
|
|
|
53 |
olcObjectIdentifier: {2}NetscapeLDAPattributeType NetscapeLDAP:1
|
|
|
54 |
olcObjectIdentifier: {3}NetscapeLDAPobjectClass NetscapeLDAP:2
|
|
|
55 |
olcObjectIdentifier: {4}OpenLDAPExp11 1.3.6.1.4.1.4203.666.11
|
|
|
56 |
olcObjectIdentifier: {5}DynGroupBase OpenLDAPExp11:8
|
|
|
57 |
olcObjectIdentifier: {6}DynGroupAttr DynGroupBase:1
|
|
|
58 |
olcObjectIdentifier: {7}DynGroupOC DynGroupBase:2
|
|
|
59 |
olcAttributeTypes: {0}( NetscapeLDAPattributeType:198 NAME 'memberURL' DESC 'I
|
|
|
60 |
dentifies an URL associated with each member of a group. Any type of labeled
|
|
|
61 |
URL can be used.' SUP labeledURI )
|
|
|
62 |
olcAttributeTypes: {1}( DynGroupAttr:1 NAME 'dgIdentity' DESC 'Identity to use
|
|
|
63 |
when processing the memberURL' SUP distinguishedName SINGLE-VALUE )
|
|
|
64 |
olcAttributeTypes: {2}( DynGroupAttr:2 NAME 'dgAuthz' DESC 'Optional authoriza
|
|
|
65 |
tion rules that determine who is allowed to assume the dgIdentity' EQUALITY a
|
|
|
66 |
uthzMatch SYNTAX 1.3.6.1.4.1.4203.666.2.7 X-ORDERED 'VALUES' )
|
|
|
67 |
olcObjectClasses: {0}( NetscapeLDAPobjectClass:33 NAME 'groupOfURLs' SUP top S
|
|
|
68 |
TRUCTURAL MUST cn MAY ( memberURL $ businessCategory $ description $ o $ ou $
|
|
|
69 |
owner $ seeAlso ) )
|
|
|
70 |
olcObjectClasses: {1}( DynGroupOC:1 NAME 'dgIdentityAux' SUP top AUXILIARY MAY
|
|
|
71 |
( dgIdentity $ dgAuthz ) )
|