©December 1999, The Open Group All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior permission of the copyright owners.

Motif®, OSF/1®, UNIX®, and the "X Device" are registered trademarks and IT DialTone^TM; and The Open Group^TM; are trademarks of The Open Group in the U.S. and other countries.

Product Standard

NAME

LDAP 2000

LABEL FOR LOGO

LDAP

When this logo is used on, or in relation to, a product registered as conformant to this Product Standard, it must be accompanied by an attribution, in the form defined in the Trademark License Agreement,¹ which includes the LDAP 2000 Product Standard name.

DESCRIPTION

The LDAP 2000 Product Standard defines core requirements for Directory servers for interoperation with LDAP clients. It includes the mandatory requirements of IETF RFC 2251, IETF RFC 2252, and IETF RFC 2253.² Detailed conformance requirements are listed below.

CONFORMANCE REQUIREMENTS

A single configuration of the system shall:

• Conform to the mandatory requirements for a server of IETF RFC 2251

• Conform to the mandatory requirements for a server of IETF RFC 2252

• Conform to the mandatory requirements for a server of IETF RFC 2253

• Return referrals and continuation references as described in IETF RFC 2251, and conform to the mandatory requirements of IETF RFC 2254 and IETF RFC 2255³ when returning LDAP URLs in referrals and continuation references

• Implement the mapping of LDAP over TCP described in Section 5.2.1 of IETF RFC 2251, in which the LDAP Message PDUs are mapped directly onto the TCP byte stream, and provide a protocol listener for this mode of operation on IP port 389 (servers may also provide listeners on other ports)

• Conform to the mandatory requirements for a server of the Secure Sockets Layer Protocol (SSL), Version 3⁴ and be capable of supplying for authentication X.509v3 certificates that conform to the requirements of IETF RFC 2459⁵ for such certificates

• Implement a mapping of LDAP over TCP in which the LDAP Message PDUs are mapped directly onto the SSL byte stream, and provide a protocol listener for this mode of operation on IP port 636 (servers may also provide listeners on other ports)

In addition, a conforming product may support any or all of the following optional features:

• Extensible Match

• Notice of Disconnection

• Client Modification of Subschema Entries

• Validation of Client SSL Certificates

• Access to SSL Credentials via SASL EXTERNAL

The Conformance Statement must state which of these features the product supports.

Where a requirement of IETF RFC 2251 or any other referenced standard is dependent on support for an optional feature, a conformant product need satisfy that requirement if, and only if, support for the feature is declared in its Conformance Statement.

If a product declares support for validation of client certificates in its Conformance Statement, then it shall be capable of validating X.509v3 certificates that conform to the requirements of IETF RFC 2459 for such certificates.

OPERATIONAL ENVIRONMENT

This Product Standard places no requirements on the operational environment of a conforming product.

PORTABILITY ENVIRONMENT

This Product Standard places no requirements on the portability environment of a conforming product.

OVERRIDING STANDARDS

IETF RFC 2251, IETF RFC 2252, IETF RFC 2253, IETF RFC 2254, IETF RFC 2255, IETF RFC 2459, and Secure Sockets Layer Protocol (SSL), Version 3 are overriding standards for this Product Standard.

INDICATORS OF COMPLIANCE

A Test Report from the currently authorized release of the VSLDAP Test Suite. Refer to http://www.opengroup.org/testing to ascertain the currently authorized version of the test suite.

Products may be registered as conformant to this Product Standard prior to General Availability of the first version of the VSLDAP Test Suite. A Test Report for any such product shall be provided to the Conformance Administrator within ninety days of the VSLDAP Test Suite achieving General Availability.

MIGRATION

As this is the first version of this Product Standard, there are no migration issues.

Footnotes

1.

Brand Program Documentation, January 1998, The Open Brand Trademark License Agreement (TMLA) (X982).

2.

IETF RFC 2251, Lightweight Directory Access Protocol (Version 3), December 1997.
IETF RFC 2252, Lightweight Directory Access Protocol (Version 3): Attribute Syntax Definitions, December 1997.
IETF RFC 2253, Lightweight Directory Access Protocol (Version 3): UTF-8 String Representation of Distinguished Names, December 1997.

3.

IETF RFC 2254, The String Representation of LDAP Search Filters, December 1997.
IETF RFC 2255, The LDAP URL Format, December 1997.

4.

The SSL Protocol, Version 3.0, Netscape Communications Corporation, March 1996.

5.

IETF RFC 2459, Internet X.509 Public Key Infrastructure Certificate and CRL Profile, January 1999.

Any comments relating to the material contained in this document may be submitted to The Open Group at:

The Open Group
Apex Plaza
Forbury Road
Reading
Berkshire, RG1 1AX
United Kingdom

OGSpecs@opengroup.org