X.500 Tables: Representing Tables and Subtrees in the X.500 Directory
Two simple patterns for keeping lookup tables and private subtrees inside an X.500 directory.
Kille, S., "Representing Tables and Subtrees in the X.500 Directory", RFC 2293, DOI 10.17487/RFC2293, March 1998, <https://www.rfc-editor.org/info/rfc2293>.
@misc{rfc2293,
series = {Request for Comments},
number = 2293,
howpublished = {RFC 2293},
publisher = {RFC Editor},
doi = {10.17487/RFC2293},
url = {https://www.rfc-editor.org/info/rfc2293},
author = {S. Kille},
title = {{Representing Tables and Subtrees in the X.500 Directory}},
pagetotal = 8,
year = 1998,
month = mar,
} RFC text
Contents
Network Working Group S. Kille
Request for Comments: 2293 Isode Ltd.
Obsoletes: 1837 March 1998
Category: Standards Track
Representing Tables and Subtrees in the X.500 Directory
Status of this Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (1998). All Rights Reserved.
Abstract
This document defines techniques for representing two types of
information mapping in the OSI Directory [1].
1. Mapping from a key to a value (or set of values), as might
be done in a table lookup.
2. Mapping from a distinguished name to an associated
value (or values), where the values are not defined by the owner
of the entry. This is achieved by use of a directory subtree.
These techniques were developed for supporting MHS use of Directory
[2], but are specified separately as they have more general
applicability.
1 Representing Flat Tables
Before considering specific function, a general purpose technique for
representing tables in the directory is introduced. The schema for
this is given in Figure 1. A table can be considered as an unordered
set of key to (single or multiple) value mappings, where the key
cannot be represented as a global name. There are four reasons why
this may occur:
1. The object does not have a natural global name.
2. The object can only be named effectively in the context of
being a key to a binding. In this case, the object will be given
a natural global name by the table.
3. The object has a global name, and the table is being used
to associate parameters with this object, in cases where they
cannot be placed in the objects global entry. Reasons why they
might not be so placed include:
o The object does not have a directory entry
o There is no authority to place the parameters in the
global entry
o The parameters are not global --- they only make sense
in the context of the table.
4. It is desirable to group information together as a
performance optimization, so that the block of information may be
widely replicated.
A table is represented as a single level subtree. The root of the
subtree is an entry of object class Table. This is named with a
common name descriptive of the table. The table will be located
somewhere appropriate to its function. If a table is private to an
MTA, it will be below the MTA's entry. If it is shared by MTA's in
an organization, it will be located under the organization.
The generic table entry contains only a description. All instances
will be subclassed, and the subclass will define the naming
attribute. Two subclasses are defined:
table OBJECT-CLASS ::= {
SUBCLASS OF {top}
MUST CONTAIN {commonName}
MAY CONTAIN {manager}
ID oc-table}
tableEntry OBJECT-CLASS ::= {
SUBCLASS OF {top}
MAY CONTAIN {description} 10
ID oc-table-entry}
textTableEntry OBJECT-CLASS ::= {
SUBCLASS OF {tableEntry}
MUST CONTAIN {textTableKey}
MAY CONTAIN {textTableValue}
ID oc-text-table-entry}
textTableKey ATTRIBUTE ::= {
SUBTYPE OF name 20
WITH SYNTAX DirectoryString {ub-name}
ID at-text-table-key}
textTableValue ATTRIBUTE ::= {
SUBTYPE OF name
WITH SYNTAX DirectoryString {ub-description}
ID at-text-table-value}
distinguishedNameTableEntry OBJECT-CLASS ::= {
SUBCLASS OF {tableEntry} 30
MUST CONTAIN {distinguishedNameTableKey}
ID oc-distinguished-name-table-entry}
distinguishedNameTableKey ATTRIBUTE ::= {
SUBTYPE OF distinguishedName
ID at-distinguished-name-table-key}
Figure 1: Representing Tables
1. TextEntry, which define table entries with text keys,
which may have single or multiple values of any type. An
attribute is defined to allow a text value, to support the
frequent text key to text value mapping. Additional values may
be defined.
2. DistinguishedNameEntry. This is used for associating
information with globally defined objects. This approach should
be used where the number of objects in the table is small or very
sparsely spread over the DIT. In other cases where there are many
objects or the objects are tightly clustered in the DIT, the
subtree approach defined in Section 2 will be preferable. No
value attributes are defined for this type of entry. An
application of this will make appropriate subtyping to define the
needed values.
This is best illustrated by example. Consider the MTA:
CN=Bells, OU=Computer Science,
O=University College London, C=GB
Suppose that the MTA needs a table mapping from private keys to fully
qualified domain names (this example is fictitious). The table might
be named as:
CN=domain-nicknames,
CN=Bells, OU=Computer Science,
O=University College London, C=GB
To represent a mapping in this table from "euclid" to
"bloomsbury.ac.uk", the entry:
TextTableKey=euclid, CN=domain-nicknames,
CN=Bells, OU=Computer Science,
O=University College London, C=GB
will contain the attribute:
TextTableValue=bloomsbury.ac.uk
A second example, showing the use of DistinguishedNameEntry is now
given. Consider again the MTA:
CN=Bells, OU=Computer Science,
O=University College London, C=GB
Suppose that the MTA needs a table mapping from MTA Name to bilateral
agreement information of that MTA. The table might be named as:
CN=MTA Bilateral Agreements,
CN=Bells, OU=Computer Science,
O=University College London, C=GB
To represent information on the MTA which has the Distinguished Name:
CN=Q3T21, ADMD=Gold 400, C=GB
There would be an entry in this table with the Relative Distinguished
Name of the table entry being the Distinguished Name of the MTA being
referred to. The MTA Bilateral information would be an attribute in
this entry. Using a non-standard notation, the Distinguished Name of
the table entry is:
DistinguishedNameTableKey=<CN=Q3T21, ADMD=Gold 400, C=GB>,
CN=MTA Bilateral Agreements,
CN=Bells, OU=Computer Science,
O=University College London, C=GB
2 Representing Subtrees
A subtree is similar to a table, except that the keys are constructed
as a distinguished name hierarchy relative to the location of the
subtree in the DIT. The subtree effectively starts a private "root",
and has distinguished names relative to this root. Typically, this
approach is used to associate local information with global objects.
The schema used is defined in Figure 2. Functionally, this is
equivalent to a table with distinguished name keys. The table
approach is best when the tree is very sparse. This approach is
better for subtrees which are more populated.
The subtree object class defines the root for a subtree in an
analogous means to the table. Information within the subtree will
generally be defined in the same way as for the global object, and so
subtree OBJECT-CLASS ::= {
SUBCLASS OF {top}
MUST CONTAIN {commonName}
MAY CONTAIN {manager}
ID oc-subtree}
Figure 2: Representing Subtrees
no specific object classes for subtree entries are needed.
For example consider University College London.
O=University College London, C=GB
Suppose that the UCL needs a private subtree, with interesting
information about directory objects. The table might be named as:
CN=private subtree,
O=University College London, C=GB
UCL specific information on Inria might be stored in the entry:
O=Inria, C=FR,
CN=private subtree,
O=University College London, C=GB
Practical examples of this mapping are given in [2].
3 Acknowledgments
Acknowledgments for work on this document are given in [2].
References
[1] The Directory --- overview of concepts, models and services,
1993. CCITT X.500 Series Recommendations.
[2] Kille, S.E., "X.400-MHS use of the X.500 directory to support
X.400-MHS routing," RFC 1801, June 1995.
4 Security Considerations
Security considerations are not discussed in this memo.
5 Author's Address
Steve Kille
Isode Ltd
The Dome
The Square
Richmond
TW9 1DT
England
Phone: +44-181-332-9091
EMail: S.Kille@ISODE.COM
A Object Identifier Assignment
mhs-ds OBJECT IDENTIFIER ::= {iso(1) org(3) dod(6) internet(1)
private(4) enterprises(1) isode-consortium (453) mhs-ds (7)}
tables OBJECT IDENTIFIER ::= {mhs-ds 1}
oc OBJECT IDENTIFIER ::= {tables 1}
at OBJECT IDENTIFIER ::= {tables 2}
oc-subtree OBJECT IDENTIFIER ::= {oc 1}
oc-table OBJECT IDENTIFIER ::= {oc 2} 10
oc-table-entry OBJECT IDENTIFIER ::= {oc 3}
oc-text-table-entry OBJECT IDENTIFIER ::= {oc 4}
oc-distinguished-name-table-entry OBJECT IDENTIFIER ::= {oc 5}
at-text-table-key OBJECT IDENTIFIER ::= {at 1}
at-text-table-value OBJECT IDENTIFIER ::= {at 2}
at-distinguished-name-table-key OBJECT IDENTIFIER ::= {at 3}
Figure 3: Object Identifier Assignment
Full Copyright Statement
Copyright (C) The Internet Society (1998). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
AI ELI5
On this page
§1Two Kinds of Lookup Information
RFC 2293 defines techniques for representing two kinds of information mapping in the OSI Directory (X.500). The first maps a key to a value or set of values, as in a table lookup. The second maps a distinguished name to an associated value or values, where the values are not defined by the owner of the entry. The second is achieved with a directory subtree.
The techniques were developed to support MHS (message handling system) use of the Directory, but the RFC specifies them separately because they have more general applicability. It obsoletes RFC 1837.
The memo gives two recipes for storing lookup lists in a big directory. One is for looking up a word, and one is for adding your own notes to someone else's entry.
§2Representing Flat Tables
A table is an unordered set of key-to-value mappings, used when the key cannot be represented as a global name. The RFC gives four reasons: the object has no natural global name; it can only be named effectively as the key to a binding; it has a global name but the table holds parameters that cannot go in its global entry; or information is grouped as a performance optimization so the block can be widely replicated.
Parameters might not go in the global entry because the object has no directory entry, there is no authority to place them there, or they only make sense in the context of the table.
A table is a single level subtree. Its root is an entry of object class table, named with a descriptive common name. The table is located where it fits its function: below the MTA's entry if private to an MTA, or under the organization if shared by the organization's MTAs.
A table is like a labelled shoebox of index cards. The box has a name, and each card inside holds one key and its answer.
§3Table Entry Classes
The generic table entry contains only a description. Every instance is subclassed, and the subclass defines the naming attribute. Two subclasses are defined.
textTableEntryhas a mandatorytextTableKeyand an optionaltextTableValue. It suits text keys that map to single or multiple values of any type, and supports the common text-to-text mapping. Additional values may be defined.distinguishedNameTableEntryhas a mandatorydistinguishedNameTableKeyand is used to associate information with globally defined objects. No value attributes are defined; an application makes appropriate subtyping to define the values it needs.
The distinguished name approach should be used when the number of objects in the table is small or very sparsely spread over the DIT. When there are many objects, or they are tightly clustered, the subtree approach is preferable.
There are two kinds of index card. One has a plain word on it. The other has a full address of something already in the book, so you can add notes about it.
§4Table Examples
The RFC's first example, which it calls fictitious, takes an MTA named CN=Bells, OU=Computer Science, O=University College London, C=GB. A table named CN=domain-nicknames sits below it. To map "euclid" to "bloomsbury.ac.uk", an entry with TextTableKey=euclid in that table holds the attribute TextTableValue=bloomsbury.ac.uk.
The second example uses distinguishedNameTableEntry. A table CN=MTA Bilateral Agreements below the same MTA maps MTA names to bilateral agreement information. The relative distinguished name of each entry is the distinguished name of the MTA it describes, such as CN=Q3T21, ADMD=Gold 400, C=GB, and the bilateral information is an attribute of that entry.
One example maps a nickname to a real computer name. The other keeps a note about another mail computer, filed under that computer's full address.
- C=GB
- O=University College London
- OU=Computer Science
- CN=Bells (MTA) holds CN=domain-nicknames
- OU=Computer Science
- O=University College London
§5Representing Subtrees
A subtree is similar to a table, except that keys are constructed as a distinguished name hierarchy relative to the subtree's location in the DIT. The subtree effectively starts a private "root" and names things relative to it. Typically it associates local information with global objects. Functionally it is equivalent to a table with distinguished name keys: the table approach is best when the tree is very sparse, and the subtree approach suits more populated trees.
The subtree object class defines the root, analogously to the table, with a mandatory common name and an optional manager. Entries inside generally use the same definitions as the global object, so no specific object classes for subtree entries are needed.
Example: University College London (O=University College London, C=GB) has a CN=private subtree below it. UCL-specific information on Inria is stored in O=Inria, C=FR, CN=private subtree, O=University College London, C=GB.
A subtree is like your own private copy of part of a map, where you can scribble notes next to places without changing the real map.
§6Security and Object Identifiers
The security section says only that security considerations are not discussed in this memo.
An appendix assigns object identifiers under the Isode consortium's mhs-ds arc for the five object classes (subtree, table, tableEntry, textTableEntry, distinguishedNameTableEntry) and the three attributes (textTableKey, textTableValue, distinguishedNameTableKey). Practical examples of the mapping, and the acknowledgments, are in RFC 1801.
The memo does not talk about safety. It does hand out unique ID numbers so every piece has its own name tag.