Appendix A - LDAP: Data Types

LDAP supports a sub-set (a pretty chunky sub-set) of the X.500 data types. Each data type is defined by its syntax (full list of OpenLDAP supported syntaxes). We define the most interesting ones in some detail.

LDAP does some nifty things when comparing and searching attributes - some notes.

Contents

Strings
Numbers (Integer)
Time
Telephone Numbers
Boolean
Binary
Distinguished Name
Bit Strings
LDAP Supported Syntaxes

LDAP Strings

The most common type of data is contained in strings - the bad news is there are a number of string types.

1. IA5String (OID=1.3.6.1.4.1.1466.115.121.1.26) IA5 (almost ASCII) character set (7-bit). Does NOT allow extended characters e.g. é, Ø, å etc.

2. DirectoryString (OID=1.3.6.1.4.1.1466.115.121.1.15) UTF-8 encoding of ISO-10646 (Unicode) - a variable byte encoding system that includes IA5/ASCII as a subset - grubby details. DOES include extended characters e.g. é, Ø, å etc. Allows matchingRules of caseIgnoreMatch and caseIgnoreSubstringsMatch.

3. PrintableString (OID=1.3.6.1.4.1.1466.115.121.1.44) IA5 (almost ASCII) string but limited to characters defined in RFC 2252 section 4.1 production p. Does NOT allow extended characters e.g. é, Ø, å etc. Allows matchingRules of caseIgnoreMatch and caseIgnoreSubstringsMatch.

4. OctetString (OID=1.3.6.1.4.1.1466.115.121.1.40) are treated as transparent 8-bit bytes. They may, or may not, be printable or human readable. Typically used by passwords. Allows matchingRules of octetStringMatch and octetStringOrderingMatch.

5. PostalAddress (OID=1.3.6.1.4.1.1466.115.121.1.41) a special format which uses UTF-8 encoding of ISO-10646 (Unicode) separated by '$' used for generating printable labels or other output. DOES allow extended characters e.g. é, Ø, å etc. Allows matchingRules of caseIgnoreListMatch and caseIgnoreListSubstringsMatch.

6. CountryString (OID=1.3.6.1.4.1.1466.115.121.1.11) special field uses IA5 (almost ASCII) character set but limited to exactly two characters describing the ISO 3166 country code. Use friendlyCountryName if full country name required. Allows matchingRules of caseIgnoreMatch and caseIgnoreSubstringsMatch.

7. NumericString (OID=1.3.6.1.4.1.1466.115.121.1.36) uses a numeric subset (RFC 2252 section 4.1 production d) of the IA5 (almost ASCII) character set. Allows matchingRules of numericStringMatch and numericStringSubstringsMatch.

LDAP Numbers

Numeric values are actually stored as strings, but do allow numeric comparisons, that is, 100 > 2 (which is not true when comparing numeric string representation). The range of values is from -2³¹ (2,147,483,648) 2³¹-1 (2,147,483,647).

1. Integer (OID=1.3.6.1.4.1.1466.115.121.1.27) Allows matchingRules of integerMatch and integerOrderingMatch.

The standard schemas contain almost no integer attributes - which is surprising.

LDAP Time Formats

1. GeneralizedTime (OID=1.3.6.1.4.1.1466.115.121.1.24) Allows matchingRules of generalizedTimeMatch and generalizedTimeOrderingMatch.

LDAP Telephone Numbers

1. TelephoneNumber (OID=1.3.6.1.4.1.1466.115.121.1.50) Allows matchingRules of telephoneNumberMatch and telephoneNumberSubstringsMatch.

LDAP Boolean

1. Boolean (OID=1.3.6.1.4.1.1466.115.121.1.7) Allows a matchingRule of booleanMatch.

LDAP Binary

1. Binary (OID=1.3.6.1.4.1.1466.115.121.1.5) There are no matchingRules for binary attributes.

LDAP Distinguished Name

1. DN (OID=1.3.6.1.4.1.1466.115.121.1.12) Allows a matchingRule of distinguishedNameMatch.

LDAP Bits Strings

1. DN (OID=1.3.6.1.4.1.1466.115.121.1.6) Allows a matchingRule of bitStringMatch.

OpenLDAP Syntaxes supported

This list below defines all supported syntaxes in OpenLDAP. This list is obtainable via the rootDSE subschema. Use this life-saving site to find the OID definition.

The list below may be obtained using the following command:

ldapsearch -H ldap://ldap.mydomain.com -x -s base -b "cn=subschema" ldapsyntaxes
# the list of attributes that may be listed are
# matchingruleuse objectclasses matchingrules attributetypes
# the above entries are collections
# createtimestamp modifytimestamp
# if you use + alone you will get a huge list of 
# everything the LDAP server knows about.

# Subschema
dn: cn=Subschema
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.4 
  DESC 'Audio' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 
  DESC 'Binary' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 
  DESC 'Bit String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 
  DESC 'Boolean' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.8 
  DESC 'Certificate' X-BINARY-TRANSFER-REQUIRED
  'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.9 
  DESC 'Certificate List' X-BINARY-TRANSFER-REQUIRED
  'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.10
  DESC 'Certificate Pair' X-BINARY-TRANSFER-REQUIRED
  'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11
  DESC 'Country String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12
  DESC 'Distinguished Name' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15
  DESC 'Directory String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22
  DESC 'Facsimile Telephone Number' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24
  DESC 'Generalized Time' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26
  DESC 'IA5 String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27
  DESC 'Integer' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28
  DESC 'JPEG' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34
  DESC 'Name And Optional UID' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36
  DESC 'Numeric String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38
  DESC 'OID' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.39
  DESC 'Other Mailbox' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40
  DESC 'Octet String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41
  DESC 'Postal Address' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44
  DESC 'Printable String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.49
  DESC 'Supported Algorithm' X-BINARY-TRANSFER-REQUIRED
  'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50
  DESC 'Telephone Number' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52
  DESC 'Telex Number' )
ldapSyntaxes: ( 1.3.6.1.1.1.0.0 DESC 'RFC2307
  NIS Netgroup Triple' )
ldapSyntaxes: ( 1.3.6.1.1.1.0.1
  DESC 'RFC2307 Boot Parameter' )
ldapSyntaxes: ( 1.2.826.0.1.3344810.7.1
  DESC 'Serial Number and Issuer' )