Subentries in the Lightweight Directory Access Protocol (LDAP)
Extracted elements (20)
Subentries are hidden from singleLevel and wholeSubtree Search by default (absent the subentries control) because they hold administrative metadata not generally relevant to directory user queries. They remain visible to baseObject Search to allow direct access by distinguished name.
This specification adapts X.500 (X.501) subentry mechanisms for use with LDAP. The SubtreeSpecification ASN.1 type is taken directly from X.501 Section 11.3. Because X.501 may extend SubtreeSpecification in future editions, the ABNF in Appendix A is a snapshot; RFC 3641 (GSER) governs encoding of any future extensions.
A subentry not of a class permitted by the administrativeRole attribute of the administrative entry cannot be subordinate to that administrative entry.
In the absence of the subentries control, subentries SHALL NOT be considered in one-level and subtree scope search operations. For all other operations, including base scope search operations, subentries SHALL be considered.
Subentries in LDAP SHALL behave in accordance with X.501 unless noted otherwise in this specification.
The controlValue of the subentries control SHALL NOT be absent; the control must always carry an explicit BOOLEAN value.
The administrativeRole operational attribute (OID 2.5.18.5) identifies the administrative roles associated with an administrative point entry. It uses objectIdentifierMatch equality and directoryOperation usage. It also regulates which subentry classes may be subordinate to an administrative entry.
The base component of SubtreeSpecification nominates the base entry of the subtree as an RDNSequence relative to the scope root; when absent or empty, the root entry of the scope is the base. Entries not subordinate to the base are excluded from the subtree.
The minimum and maximum components of ChopSpecification bound subtree depth. Entries fewer than minimum RDN arcs below the base are excluded; entries more than maximum RDN arcs below are excluded. Absent maximum means no upper depth limit.
The specificationFilter component is a Refinement — a boolean expression (item/and/or/not) over objectClass OIDs. An entry is excluded from the subtree refinement if the filter evaluates to false for that entry. If absent, no entries are excluded based on objectClass.
The specificExclusions component is a list of chopBefore and chopAfter exclusions. chopBefore excludes the named entry and all its subordinates; chopAfter excludes only the subordinates of the named entry, leaving the entry itself in scope.
The subentries control (controlType 1.3.6.1.4.1.4203.1.10.1) MAY be included in a SearchRequest to toggle visibility between subentries and normal entries. A TRUE controlValue makes only subentries visible; FALSE makes only normal entries visible. The control has no corresponding response control and is not appropriate for non-Search operations.
The subentry structural object class (OID 2.5.17.0) is a subclass of top and requires both cn and subtreeSpecification attributes. All subentries must be of this class or a subclass thereof.
The subtreeSpecification operational attribute (OID 2.5.18.6) is a single-valued directoryOperation attribute of SubtreeSpecification syntax. It is present in all subentries and nominates the collections of entries governed by an aspect of administrative authority.
The SubtreeSpecification syntax provides a general-purpose mechanism for specifying a subset of entries in a DIT subtree. It consists of a base entry, optional specificExclusions, minimum/maximum depth bounds, and an optional specificationFilter (a boolean expression over objectClass OIDs). Its LDAP OID is 1.3.6.1.4.1.1466.115.121.1.45.
IANA registered the following LDAP descriptors defined in this specification: accessControlInnerArea (R, 2.5.23.3), accessControlSpecificArea (R, 2.5.23.2), administrativeRole (A, 2.5.18.5), autonomousArea (R, 2.5.23.1), collectiveAttributeInnerArea (R, 2.5.23.6), collectiveAttributeSpecificArea (R, 2.5.23.5), subentry (O, 2.5.17.0), subschemaAdminSpecificArea (R, 2.5.23.4), subtreeSpecification (A, 2.5.18.6).
IANA registered the subentries Search control (OID 1.3.6.1.4.1.4203.1.10.1) in the LDAP Protocol Mechanisms registry under RFC 3383, with usage type Control and specification RFC 3672.
Subentries often hold administrative information or other sensitive information and should be protected from unauthorized access and disclosure as described in RFC 2829 (LDAP authentication) and RFC 2830 (LDAP TLS). General LDAP security considerations from RFC 3377 also apply.
SubtreeSpecification is encoded as an ASN.1 SEQUENCE with optional base (LocalName), specificExclusions (SET OF chopBefore/chopAfter LocalName), minimum (BaseDistance INTEGER, default 0), maximum (BaseDistance INTEGER), and specificationFilter (Refinement CHOICE of item/and/or/not). The LDAP-specific string encoding is defined by the Generic String Encoding Rules (RFC 3641).
The subentries control's controlValue contains a BER-encoded BOOLEAN: TRUE visibility encodes as { 01 01 FF } (3 octets) and FALSE visibility encodes as { 01 01 00 } (3 octets). The controlValue SHALL NOT be absent.