Skip to main content

LDAP Schema

schemafor
rfc1274COSINE, X.500
rfc2256X.500 User Schema for use with LDAPv3
rfc2798inetOrgPerson
rfc3712Printer Services
rfc4403UDDIv3
rfc4519User Applications
rfc4523X.509
rfc4524COSINE/X.500
rfc4530entryUUID
rfc5020entryDN
rfc5803SCRAM - Storing Salted Challenge Response Authentication Mechanism
rfc7612Printer Services
rfc8284XMPP in White Pages
namestand for含义
dndistinguished name专有名称
cnCommon Name通用名、全名
dcDomain Componentwener.me -> dc=wener,dc=me
ouOrganizational Unit组织单位
snsurname姓
ccountry国家
oOrganization组织
  • Schema 分类
    • 对象类
    • 属性类型
    • 语法
    • 匹配规则
  • 用户 - 常用 inetOrgPerson, organizationalPerson
    • inetOrgPerson
      • SUP organizationalPerson
      • MUST: cn, objectClass, sn
    • organizationalPerson
    • account
      • MUST: uid
      • MAY: description, seeAlso, l, o, ou, host
    • person
      • MUST: sn, cn
      • MAY: userPassword, telephoneNumber, seeAlso, description
  • UserID
    • uid
    • sAMAccountName - Active directory
    • cn - AD RDN
  • UUID
    • entryUUID
    • objectGUID - Active directory
    • entryDN/uid - 如果不支持 UUID
  • 分组
    • groupOfUniqueNames
    • member
  • ServiceAccount
    • account,simpleSecurityObject,top
    • applicationProcess
  • top - RFC 2256
  • simpleSecurityObject - RFC 1274
    • MUST: userPassword
  • schema
    • NAME
    • DESC
    • SUP
    • ABSTRACT
    • MUST
    • MAY
    • X-ORIGIN
    • AUXILIARY
    • STRUCTURAL
  • :: base64
  • value 不能包含前后空白
# 陈小明
dn: uid=chenxiaoming,ou=users,dc=wener,dc=me
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
cn: 陈小明
sn: 陈
uid: chenxiaoming

Internal​

attrexample
createTimestamp20220823142347Z
creatorsNamecn=admin,dc=wener,dc=me
entryCSN20220823142347.481919Z#000000#000#000000
entryDNcn=user,ou=groups,dc=wener,dc=me
entryUUID55ef9487-c39f-4697-8314-68d1752bfe02
hasSubordinatesFALSE
modifiersNamecn=admin,dc=wener,dc=me
modifyTimestamp20220823142347Z
structuralObjectClassposixGroup
subschemaSubentrycn=Subschema

Linux​

group attr-
gidNumber
cn
user attr-
uidNumber
gidNumber
cn
uid
gecos
homeDirectory
loginShell
unixHomeDirectory
unixUserPassword
attr-
shadowWarning
shadowInactive
shadowMin
shadowMax
shadowExpire
shadowLastChange

SSH​

openssh-lpk.ldif
dn: cn=openssh-lpk,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: openssh-lpk
olcAttributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
    DESC 'MANDATORY: OpenSSH Public key'
    EQUALITY octetStringMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
olcObjectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
    DESC 'MANDATORY: OpenSSH LPK objectclass'
    MAY ( sshPublicKey $ uid )
    )

RFC1274 The COSINE and Internet X.500 Schema​

RFC2256 X.500 User Schema for use with LDAPv3​

Attribute Typesstand fore.g.
objectClass
aliasedObjectName
knowledgeInformation
cn
sn
serialNumber
c
l
street
o
ou
title
description
searchGuide
businessCategory
postalAddress
postalCode
postOfficeBox
physicalDeliveryOfficeName
telephoneNumber
telexNumber
teletexTerminalIdentifier
facsimileTelephoneNumber
x121Address
internationaliSDNNumber
registeredAddress
destinationIndicator
preferredDeliveryMethod
presentationAddress
supportedApplicationContext
member
owner
roleOccupant
seeAlso
userPassword
userCertificate
cACertificate
authorityRevocationList
certificateRevocationList
crossCertificatePair
name
givenName
initials
generationQualifier
x500UniqueIdentifier
dnQualifier
enhancedSearchGuide
distinguishedName
uniqueMember
houseIdentifier
supportedAlgorithms
deltaRevocationList
dmdNamedirectory management domain
Object ClassesMUST
top
aliasaliasedObjectName
country
locality
organization
organizationalUnit
personsn, cn
organizationalPerson
organizationalRolecn
groupOfNamesmember,cn
residentialPerson
applicationProcess
applicationEntitypresentationAddress , cn
dSAcn
strongAuthenticationUser
certificationAuthority
groupOfUniqueNames
userSecurityInformation
certificationAuthority-V2
cRLDistributionPoint
dmd
  • octetStringMatch

RFC2719 inetOrgPerson​

Attribute Typesstand fore.g.
carLicense
departmentNumber
displayName
employeeNumber
employeeTypeContractor,Employee,Intern,Temp,External,Unknown
jpegPhotobinary
preferredLanguage
userSMIMECertificate
userPKCS12
AttributeMeaning
uiduserid
initials首字母
sn姓
givenName名
cn名字、全名
displayName昵称、显示名称
mail
telephoneNumber
mobile
roomNumber
carLicense
title职位
employeeNumber工号
employeeType员工类型，例如 正式员工，兼职
o公司名称
ou部门名称
departmentNumber部门编号
jpegPhoto头像、二进制数据
photo头像地址
manager主管
audio
businessCategory
homePhone
homePostalAddress
initials
labeledURI
pager
secretary
userCertificate
x500uniqueIdentifier
preferredLanguage
userSMIMECertificate
userPKCS12

RFC4524 COSINE LDAP/X.500 Schema​

RFC4519 User Applications​

  • organization
    • MUST o
  • organizationalPerson
    • SUP person
  • organizationalRole - 代表工作和职位
    • MUST cn
  • organizationalUnit - 代表部门
    • MUST ou
  • Schema for User Applications
Attribute Typesstand fore.g.
businessCategory
ccountryNameEN,US ISO3166
cncommonName例如 person 的 fullname
dcdomainComponent
description
destinationIndicatorcountry or city
distinguishedNamedn继承属性
dnQualifier
enhancedSearchGuide
facsimileTelephoneNumber
generationQualifier
givenNamefirst name
houseIdentifier
initials
internationalISDNNumber电话号吗
llocalityNameX.500
member
name继承属性
oorganizationNameX.500
ouorganizationalUnitNameX.500
owner
physicalDeliveryOfficeName
postalAddress
postalCode
postOfficeBox
preferredDeliveryMethod
registeredAddress
roleOccupant
searchGuide
seeAlso
serialNumber
snsurnameX.500
ststateOrProvinceNameX.500
streetstreetAddressX.500
telephoneNumber
teletexTerminalIdentifier
telexNumber
title职称
uiduserid
uniqueMember
userPassword
Object ClassesMUST
applicationProcess
country
dcObject
device
groupOfNames
groupOfUniqueNames
locality
organization
organizationalPerson
organizationalRole
organizationalUnit
person
residentialPerson
uidObject

RFC4524 COSINE​

  • Attribute Types
    • associatedDomain
    • associatedName
    • buildingName
    • co - Friendly Country Name
    • documentAuthor
    • documentIdentifier
    • documentLocation
    • documentPublisher
    • documentTitle
    • documentVersion
    • drink
    • homePhone
    • homePostalAddress
    • host
    • info
    • mail
    • manager
    • mobile
    • organizationalStatus
    • pager
    • personalTitle
    • roomNumber
    • secretary
    • uniqueIdentifier
    • userClass
  • Object Classes
    • account
    • document
    • documentSeries
    • domain
    • domainRelatedObject
    • friendlyCountry
    • rFC822LocalPart
    • room
    • simpleSecurityObject
  • COSINE - Cooperation for Open Systems Interconnection Networking in Europe