Lightweight Directory Access Protocol (LDAP) entryUUID Operational Attribute
Extracted elements (15)
Distinguished names are not stable identifiers: a new object may receive a DN that previously identified a different (renamed or deleted) object. UUIDs are introduced to provide stable, space-and-time-unique identifiers that clients can use to distinguish or relocate objects across renames.
The 'uuidOrderingMatch' rule is provided for completeness even though not all UUID variants have a defined ordering and servers are not obligated to assign UUIDs in any particular order.
Servers MUST ensure that each generated UUID is unique in space and time, generated in accordance with Section 4 of RFC 4122.
Servers SHALL generate and assign a new UUID to each entry upon its addition to the directory and provide that UUID as the value of the 'entryUUID' operational attribute. An entry's UUID is immutable.
The 'entryUUID' operational attribute holds the server-assigned UUID for each directory entry. It is single-valued, immutable, not user-modifiable, and used as a directoryOperation attribute with OID 1.3.6.1.1.16.4.
The UUID syntax (OID 1.3.6.1.1.16.1) represents a 16-octet (128-bit) Universally Unique Identifier as defined in RFC 4122. The LDAP syntax description is: ( 1.3.6.1.1.16.1 DESC 'UUID' ).
The 'uuidMatch' matching rule (OID 1.3.6.1.1.16.2) compares an asserted UUID with a stored UUID for equality, with semantics identical to 'octetStringMatch' except the assertion value uses UUID string representation rather than normal OCTET STRING encoding.
The 'uuidOrderingMatch' matching rule (OID 1.3.6.1.1.16.3) compares an asserted UUID with a stored UUID for ordering, with semantics identical to 'octetStringOrderingMatch' except the assertion value uses UUID string representation.
IANA registered an LDAP Object Identifier (1.3.6.1.1.16) identifying the UUID schema elements defined in this document, per RFC 4520.
IANA registered the 'entryUUID' attribute type descriptor with OID 1.3.6.1.1.16.4.
IANA registered the UUID LDAP syntax with OID 1.3.6.1.1.16.1 and descriptor 'UUID'.
IANA registered the 'uuidMatch' matching rule descriptor with OID 1.3.6.1.1.16.2 and the 'uuidOrderingMatch' matching rule descriptor with OID 1.3.6.1.1.16.3.
General UUID security considerations from RFC 4122 apply, as do general LDAP security considerations from RFC 4510.
UUIDs do not contain descriptive information about the object they identify, so they can be used to reference a particular entry without disclosing its contents—useful when entry naming attributes contain information that cannot be disclosed to all parties.
UUID values in LDAP are encoded as ASCII character strings in the format described in RFC 4122, e.g., '597ae2f6-16a6-1027-98f4-d28b5365dc14'. The underlying ASN.1 type is OCTET STRING of SIZE(16) (128 bits).