OwlCyberSecurity - MANAGER

Edit File: draft-sermersheim-ldap-subordinate-scope-xx.txt

Network Working Group J;. Sermersheim Internet-Draft Novell, Inc Updates: 2251 (if approved) July 2004 Expires: December 30, 2004 Subordinate Subtree Search Scope for LDAP draft-sermersheim-ldap-subordinate-scope-00.txt Status of this Memo This document is an Internet-Draft and is subject to all provisions of section 3 of RFC 3667. By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she become aware will be disclosed, in accordance with RFC 3668. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt. The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. This Internet-Draft will expire on December 30, 2004. Copyright Notice Copyright (C) The Internet Society (2004). Abstract The Lightweight Directory Application Protocol (LDAP) specification supports three scope values for the search operation -- namely: baseObject, singleLevel, and wholeSubtree. This document introduces a subordinateSubtree scope which constrains the search scope to all subordinates of the named base object. Discussion Forum Sermersheim Expires December 30, 2004 [Page 1]  Internet-Draft Subordinate Subtree Search Scope for LDAP July 2004 Technical discussion of this document will take place on the IETF LDAP Extensions mailing list <ldapext@ietf.org>. Please send editorial comments directly to the author. 1. Overview There are a number of reasons which have surfaced for introducing a Lightweight Directory Application Protocol (LDAP) [RFC3377] SearchRequest.scope [RFC2251] which constrains the search scope to all subordinates of the named base object, and does not include the base object (as wholeSubtree does). These reasons range from the obvious utility of allowing an LDAP client application the ability to exclude the base object from a wholeSubtree search scope, to distributed operation applications which require this scope for progressing search sub-operations resulting from an nssr DSE type reference. To meet these needs, the subordinateSubtree scope value is introduced. The subordinateSubtrees cope is applied to the SearchRequest.scope field, the <scope> type and alternately the <extension> type of the LDAP URL [RFC2255] and may be applied to other specifications which include an LDAP search scope. A mechanism is also given which allows LDAP Directory Server Agents (DSA)s to advertise support of this search scope. 2. Application to SearchRequest.scope A new item is added to this ENUMERATED type. The identifier is subordinateSubtree and the number is 4. A DSA which receives and supports the subordinateSubtree SearchRequest.scope constrains the search scope to all subordinate objects. A DSA which receives but does not support the subordinateSubtree SearchRequest.scope returns a protocolError resultCode in the SearchResultDone. 3. LDAP URL applications The LDAP URL [RFC2255] specification allows the conveyance of a search scope. This section intoduces two ways in which the subordinateScope search scope may be conveyed in an LDAP URL. One way is by allowing a new "subord" scope in the <scope> part. Another way is through the introduction of an LDAP URL extension. The LDAP URL extension method is preferred for its criticality semantics. Sermersheim Expires December 30, 2004 [Page 2]  Internet-Draft Subordinate Subtree Search Scope for LDAP July 2004 3.1 Application to LDAP URL <scope> A new <scope> value of "subord" is added. Using the <scope> type from LDAP URL [RFC2255], the ABNF is as follows: scope /= "subord" Implementations processing but which do not understand or support the "subord" <scope> of an LDAP URL raise an appropriate error. 3.2 Application to LDAP URL <extension> An LDAP URL <extension> mechanism is introduced here. The <extype> is IANA-ASSIGNED-OID.1 or the descriptor 'subordScope', and the exvalue is omitted. The extension may be marked as either critical or non-critical. If supported, the subordScope extension overrides any value set in the <scope> field. 4. DSA Advertisement of support A DSA may advertise its support of the subordinateSubtree item in the SearchRequest.scope by inclusion of IANA-ASSIGNED-OID.2 in the 'supportedFeatures' attribute of the root DSE. 5. Security Considerations This specification introduces no security concerns above any associated with the existing wholeSubtree search scope value. As with the wholeSubtree search scope, this scope specifies that a search be applied to an entire subtree hierarchy. Implementations should be aware of the relative cost of using or allowing this scope. 6 Normative References [RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory Access Protocol (v3)", RFC 2251, December 1997. [RFC2255] Howes, T. and M. Smith, "The LDAP URL Format", RFC 2255, December 1997. [RFC3377] Hodges, J. and R. Morgan, "Lightweight Directory Access Protocol (v3): Technical Specification", RFC 3377, September 2002. [RFC3383] Zeilenga, K., "Internet Assigned Numbers Authority (IANA) Sermersheim Expires December 30, 2004 [Page 3]  Internet-Draft Subordinate Subtree Search Scope for LDAP July 2004 Considerations for the Lightweight Directory Access Protocol (LDAP)", BCP 64, RFC 3383, September 2002. Author's Address Jim Sermersheim Novell, Inc 1800 South Novell Place Provo, Utah 84606 USA Phone: +1 801 861-3088 EMail: jimse@novell.com Appendix A. IANA Considerations Registration of the following values is requested [RFC3383]. A.1 LDAP Object Identifier Registrations It is requested that IANA register upon Standards Action an LDAP Object Identifier in identifying the protocol elements defined in this technical specification. The following registration template is provided: Subject: Request for LDAP OID Registration Person & email address to contact for further information: Jim Sermersheim jimse@novell.com Specification: RFCXXXX Author/Change Controller: IESG Comments: 2 delegations will be made under the assigned OID: IANA-ASSIGNED-OID.1 subordScope LDAP URL extension IANA-ASSIGNED-OID.2 subordinateScope Supported Feature A.2 LDAP Protocol Mechanism Registrations It is requested that IANA register upon Standards Action the LDAP protocol mechanism described in this document. The following registration templates are given: Subject: Request for LDAP Protocol Mechanism Registration Object Identifier: IANA-ASSIGNED-OID.1 Description: subordScope LDAP URL extension Person & email address to contact for further information: Sermersheim Expires December 30, 2004 [Page 4]  Internet-Draft Subordinate Subtree Search Scope for LDAP July 2004 Jim Sermersheim jimse@novell.com Usage: Extension Specification: RFCXXXX Author/Change Controller: IESG Comments: none A.3 LDAP Descriptor Registrations It is requested that IANA register upon Standards Action the LDAP descriptors described in this document. The following registration templates are given: Subject: Request for LDAP Descriptor Registration Descriptor (short name): subordScope Object Identifier: IANA-ASSIGNED-OID.1 Person & email address to contact for further information: Jim Sermersheim jimse@novell.com Usage: URL Extension Specification: RFCXXXX Author/Change Controller: IESG Comments: none Sermersheim Expires December 30, 2004 [Page 5]  Internet-Draft Subordinate Subtree Search Scope for LDAP July 2004 Intellectual Property Statement The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79. Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org. Disclaimer of Validity This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright Statement Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. Acknowledgment Funding for the RFC Editor function is currently provided by the Internet Society. Sermersheim Expires December 30, 2004 [Page 6]