7.1 Overview of Directory Schema

7.1.1 Object Classes

An object class is an LDAP directory term that denotes the type of object being represented by a directory entry or record. There are also object classes that define an object's relationship to other objects, such as object class top denotes that the object may have subordinate objects under it in a hierarchical tree structure. Some LDAP object classes may be combined to create an entry in the directory. For example, and entry for a user uses the top, person, organizationalPerson, inetOrgPerson, and orclUserV2 object classes.

Required and Allowed Attributes

The definition of an object class includes a list of required attributes (MUST) and allowed attributes (MAY). Required attributes include the attributes that must be present in entries using the object class. Allowed attributes include the attributes that may be present in entries using the object class.

Object Class Types

The X.500 1993 specification requires that object classes be assigned to one of four categories:

• Structural: Object classes that can have instances in the directory. Structural classes are used to create directory objects or entries.

• Abstract: Template object classes that are used only to derive new structural classes. Abstract classes cannot be instantiated in the directory.

• Auxiliary: A list of attributes that can be appended to the definition of a Structural or Abstract class. An Auxiliary class cannot be instantiated in the directory.

• 88 Classes: Assigning object classes to categories was not required in the X.500 1988 specification. Classes that were defined prior to the X.500 1993 standards, default to the 88 class. Do not define new 88 classes.

Object Class Inheritance

Inheritance, which is also referred to as derivation, is the ability to build new object classes from existing object classes. The new object is defined as a subclass of the parent object. A subclass is a class that inherits from some other class; for example, a subclass inherits structure and content rules from the parent. The parent object becomes a superclass of the new object. A superclass is a class from which one or more other classes inherit information.

7.1.2 Attributes

Directory data is represented as attribute-value pairs. Any piece of information in the directory is associated with a descriptive attribute. For example, the cn (commonName) attribute is used to store a nickname. A person named William (Bill) Smith can be represented in the directory as:

cn: Bill Smith

Attribute Syntax

An attribute syntax is the basic building block of an attribute. Every attribute is assigned a syntax that defines the attribute value's data format. For example, attribute syntaxes determine whether an attribute stores an integer, string, or binary data. The syntax also defines the matching rules that control the type of comparison operations you can perform on the attribute value.

Oracle Internet Directory recognizes attribute syntax as specified in RFC 2252, that is, it enables you to associate the attribute syntax described in that document with an attribute. Oracle Internet Directory enforces attribute syntax for the following types:

• DN

• OID (object identifier)

• Telephone Number

The following table describes the attribute syntax most commonly used in Oracle Internet Directory:

Matching Rules

Matching rules are the rules for matching two attribute values that comply with the same attribute syntax. Oracle Internet Directory recognizes the following matching rule definitions in the schema.

• accessDirectiveMatch

• IntegerMatch

• bitStringMatch

• numericStringMatch

• caseExactMatch

• objectIdentifierFirstComponentMatch

• caseExactIA5Match

• ObjectIdentifierMatch

• caseIgnoreIA5Match

• OctetStringMatch

• caseIgnoreListMatch

• presentationAddressMatch

• caseIgnoreMatch

• protocolInformationMatch

• caseIgnoreOrderingMatch

• telephoneNumberMatch

• distinguishedNameMatch

• uniqueMemberMatch

• generalizedTimeMatch

• generalizedTimeOrderingMatch

• orclpkimatchingrule

Of the matching rules in the previous list, Oracle Internet Directory actually enforces the following when it compares attribute values:

• distinguishedNameMatch

• caseExactMatch

• caseIgnoreMatch

• numericStringMatch

• IntegerMatch

• telephoneNumberMatch

• orclpkimatchingrule

Sizing of Attribute Values

Attribute syntax does not put any specific size constraint on attribute values. You can, however, specify the size of the attribute value when defining the attribute. Some attributes in Oracle Internet Directory may have size constraints defined, however length characteristics of an attribute are not enforced.

For example, to limit an attribute foo to a size of 64, you would define the attribute as follows:

(object_identifier_of_attribute NAME 'foo' EQUALITY caseIgnoreMatch SYNTAX 'object_identifier_of_syntax{64}')

Single-Valued and Multi-Valued Attributes

By default, most attributes are multi-valued. This means that an entry can contain the same attribute with multiple values. For single-valued attributes, only one instance of the attribute can be specified in an entry. For example, the attribute orclObjectGUID attribute can only have one possible value.

Attribute Usage

Attribute Usage defines how the attribute is used in the directory. The attribute usage types are:

• userApplications - User applications attribute. This is the default attribute usage if not explicitly defined for the attribute.

• directoryOperation - Directory operational attribute.

• dSAOperation - DSA operational attribute.

Not User Modifiable

Attributes that are designated as "not user modifiable" can only be modified by the directory server. They cannot be modified by any other user or process.

7.1.3 LDAP Controls

As an LDAP Version 3 directory, Oracle Internet Directory extends the standard LDAP operations by using controls. These are extra pieces of information carried along with existing operations, altering the behavior of the operation. When a client application passes a control along with the standard LDAP command, the behavior of the commanded operation is altered accordingly.