rfc-5020

The Lightweight Directory Access Protocol (LDAP) entryDN Operational Attribute

K. Zeilenga

date2007-08 streamIETF wgnon working group statusPROPOSED STANDARD pages5 canonicalhttps://www.rfc-editor.org/rfc/rfc5020 doi10.17487/RFC5020

This document describes the Lightweight Directory Access Protocol (LDAP) / X.500 'entryDN' operational attribute. The attribute provides a copy of the entry's distinguished name for use in attribute value assertions. [STANDARDS-TRACK]

Extracted elements (6)

design-rationale §1

In X.500/LDAP, an entry's DN is not itself an attribute of the entry, making it impossible to perform attribute value assertions against it. The 'entryDN' attribute was introduced specifically to enable search filters (including componentFilterMatch) to match against DN components.

ldap

interoperability-note §1

The 'entryDN' attribute may be used in search filters in conjunction with the 'componentFilterMatch' and 'rdnMatch' matching rules defined in RFC 3687, enabling fine-grained DN component matching in LDAP searches.

ldap

normative-requirement §2 MUST NOT

The DN of the entry cannot be modified through the 'entryDN' attribute, which is marked NO-USER-MODIFICATION.

ldap

protocol-element §2

The 'entryDN' operational attribute holds a copy of the entry's current distinguished name (DN). It has OID 1.3.6.1.1.20, uses the distinguishedNameMatch equality rule, DN syntax (1.3.6.1.4.1.1466.115.121.1.12), is SINGLE-VALUE, NO-USER-MODIFICATION, and has USAGE directoryOperation.

ldap

registry §4

IANA registered LDAP Object Identifier 1.3.6.1.1.20 for the 'entryDN' attribute type, and registered the 'entryDN' descriptor as an LDAP Attribute Type descriptor, both upon Standards Action per RFC 4520.

ldap, registry

security-consideration §3

The 'entryDN' attribute only provides an additional mechanism to access an entry's DN, which is already accessible by other means. Its introduction is not believed to introduce new security considerations.

ldap, security