Network Working Group K. Zeilenga
Request for Comments: 3671 OpenLDAP Foundation
Category: Standards Track December 2003
Network Working Group K. Zeilenga
Request for Comments: 3671 OpenLDAP Foundation
Category: Standards Track December 2003
Collective Attributes in the Lightweight Directory Access Protocol (LDAP)
轻量级目录访问协议（LDAP）中的集合属性
Status of this Memo
本备忘录的状况
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
本文件规定了互联网社区的互联网标准跟踪协议，并要求进行讨论和提出改进建议。有关本协议的标准化状态和状态，请参考当前版本的“互联网官方协议标准”（STD 1）。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (2003). All Rights Reserved.
版权所有（C）互联网协会（2003年）。版权所有。
Abstract
摘要
X.500 collective attributes allow common characteristics to be shared between collections of entries. This document summarizes the X.500 information model for collective attributes and describes use of collective attributes in LDAP (Lightweight Directory Access Protocol). This document provides schema definitions for collective attributes for use in LDAP.
X.500集合属性允许在条目集合之间共享公共特征。本文档总结了集合属性的X.500信息模型，并描述了集合属性在LDAP（轻量级目录访问协议）中的使用。本文档为LDAP中使用的集合属性提供模式定义。
In X.500 [X.500], a collective attribute is "a user attribute whose values are the same for each member of an entry collection" [X.501]. This document details their use in the Lightweight Directory Access Protocol (LDAP) [RFC3377].
在X.500[X.500]中，集合属性是“其值对于条目集合的每个成员都相同的用户属性”[X.501]。本文档详细介绍了它们在轻量级目录访问协议（LDAP）[RFC3377]中的使用。
A collection of entries is a grouping of object and alias entries based upon common properties or shared relationship between the corresponding entries which share certain attributes. An entry collection consists of all entries within scope of a collective attributes subentry [RFC3672]. An entry can belong to several entry collections.
条目集合是基于共享某些属性的相应条目之间的公共属性或共享关系对对象和别名条目进行的分组。条目集合由集合属性子条目[RFC3672]范围内的所有条目组成。一个条目可以属于多个条目集合。
Attributes shared by the entries comprising an entry collection are called collective attributes. Values of collective attributes are visible but not updateable to clients accessing entries within the collection. Collective attributes are updated (i.e., modified) via their associated collective attributes subentry.
组成条目集合的条目共享的属性称为集合属性。集合属性的值对访问集合中的项的客户端可见，但不可更新。集合属性通过其关联的集合属性子项进行更新（即修改）。
When an entry belongs to multiple entry collections, the entry's values of each collective attribute are combined such that independent sources of these values are not manifested to clients.
当一个条目属于多个条目集合时，将组合每个集合属性的条目值，以便这些值的独立来源不会显示给客户端。
Entries can specifically exclude a particular collective attribute by listing the attribute as a value of the collectiveExclusions attribute. Like other user attributes, collective attributes are subject to a variety of controls including access, administrative, and content controls.
条目可以通过将特定集合属性列为CollectiveExclutions属性的值来明确排除该属性。与其他用户属性一样，集合属性受各种控制，包括访问、管理和内容控制。
Schema definitions are provided using LDAPv3 [RFC2251] description formats [RFC2252]. Definitions provided here are formatted (line wrapped) for readability.
使用LDAPv3[RFC2251]描述格式[RFC2252]提供模式定义。为了便于阅读，这里提供的定义是格式化的（换行）。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照BCP 14[RFC2119]中所述进行解释。
The following operational attributes are used to manage Collective Attributes. LDAP servers [RFC3377] MUST act in accordance with the X.500 Directory Models [X.501] when providing this service.
以下操作属性用于管理集合属性。提供此服务时，LDAP服务器[RFC3377]必须按照X.500目录模型[X.501]操作。
Subentries of this object class are used to administer collective attributes and are referred to as collective attribute subentries.
此对象类的子项用于管理集合属性，称为集合属性子项。
( 2.5.17.2 NAME 'collectiveAttributeSubentry' AUXILIARY )
（2.5.17.2名称“集合属性子项”辅助）
A collective attribute subentry SHOULD contain at least one collective attribute. The collective attributes contained within a collective attribute subentry are available for finding, searching, and comparison at every entry within the scope of the subentry. The collective attributes, however, are administered (e.g., modified) via the subentry.
集合属性子项应至少包含一个集合属性。集合属性子项中包含的集合属性可用于在子项范围内的每个项上查找、搜索和比较。但是，集合属性是通过子项管理（例如，修改）的。
Implementations of this specification SHOULD support collective attribute subentries in both collectiveAttributeSpecificArea (2.5.23.5) and collectiveAttributeInnerArea (2.5.23.6) administrative areas [RFC3672][X.501].
本规范的实现应支持collectiveAttributeSpecificArea（2.5.23.5）和collectiveAttributeInnerArea（2.5.23.6）管理区域[RFC3672][X.501]中的集合属性子项。
The collectiveAttributeSubentries operational attribute identifies all collective attribute subentries that affect the entry.
CollectiveAttributesSubEntries操作属性标识影响该项的所有集合属性子项。
( 2.5.18.12 NAME 'collectiveAttributeSubentries' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE directoryOperation NO-USER-MODIFICATION )
（2.5.18.12名称“collectiveAttributeSubentries”相等区分名称匹配语法1.3.6.1.4.1.1466.115.121.1.12使用指南操作无用户修改）
The collectiveExclusions operational attribute allows particular collective attributes to be excluded from an entry. It MAY appear in any entry and MAY have multiple values.
CollectiveExclutions操作属性允许从条目中排除特定的集合属性。它可能出现在任何条目中，并且可能有多个值。
( 2.5.18.7 NAME 'collectiveExclusions' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE directoryOperation )
（2.5.18.7名称“CollectiveExclutions”相等objectIdentifierMatch语法1.3.6.1.4.1.1466.115.121.1.38使用目录操作）
The descriptor excludeAllCollectiveAttributes is associated with the OID 2.5.18.0. When this descriptor or OID is present as a value of the collectiveExclusions attribute, all collective attributes are excluded from an entry.
描述符excludeAllCollectiveAttributes与OID 2.5.18.0相关联。当此描述符或OID作为CollectiveExclutions属性的值出现时，将从条目中排除所有集合属性。
A userApplications attribute type can be defined to be COLLECTIVE [RFC2252]. This indicates that the same attribute values will appear in the entries of an entry collection subject to the use of the collectiveExclusions attribute and other administrative controls. These administrative controls MAY include DIT Content Rules, if implemented.
userApplications属性类型可以定义为集合[RFC2252]。这表示在使用CollectiveExclutions属性和其他管理控件的情况下，条目集合的条目中将显示相同的属性值。如果实施，这些管理控制可能包括DIT内容规则。
Collective attribute types are commonly defined as subtypes of non-collective attribute types. By convention, collective attributes are named by prefixing the name of their non-collective supertype with "c-". For example, the collective telephone attribute is named c-TelephoneNumber after its non-collective supertype telephoneNumber.
集合属性类型通常定义为非集合属性类型的子类型。按照惯例，集合属性是通过在其非集合超类型的名称前面加上“c-”来命名的。例如，集合电话属性在其非集合超类型TelephoneNumber之后命名为c-TelephoneNumber。
Non-collective attributes types SHALL NOT subtype collective attributes.
非集合属性类型不得作为集合属性的子类型。
Collective attributes SHALL NOT be SINGLE-VALUED. Collective attribute types SHALL NOT appear in the attribute types of an object class definition.
集体属性不得为单值属性。集合属性类型不得出现在对象类定义的属性类型中。
Operational attributes SHALL NOT be defined to be collective.
操作属性不得定义为集合属性。
The remainder of section provides a summary of collective attributes derived from those defined in [X.520]. The SUPerior attribute types are described in [RFC 2256] for use with LDAP.
第节的其余部分总结了从[X.520]中定义的集合属性衍生而来的集合属性。[RFC 2256]中描述了用于LDAP的高级属性类型。
Implementations of this specification SHOULD support the following collective attributes and MAY support additional collective attributes.
本规范的实现应支持以下集合属性，并可能支持其他集合属性。
The c-l attribute type specifies a locality name for a collection of entries.
c-l属性类型为条目集合指定位置名称。
( 2.5.4.7.1 NAME 'c-l' SUP l COLLECTIVE )
（2.5.4.7.1名称“c-l”SUP l集合）
The c-st attribute type specifies a state or province name for a collection of entries.
c-st属性类型为条目集合指定州或省的名称。
( 2.5.4.8.1 NAME 'c-st' SUP st COLLECTIVE )
（2.5.4.8.1名称“c-st”SUP-st集合）
The c-street attribute type specifies a street address for a collection of entries.
c-street属性类型为条目集合指定街道地址。
( 2.5.4.9.1 NAME 'c-street' SUP street COLLECTIVE )
（2.5.4.9.1名称“c街”SUP street集合）
The c-o attribute type specifies an organization name for a collection of entries.
c-o属性类型为条目集合指定组织名称。
( 2.5.4.10.1 NAME 'c-o' SUP o COLLECTIVE )
（2.5.4.10.1名称“c-o”辅助集体）
The c-ou attribute type specifies an organizational unit name for a collection of entries.
c-ou属性类型为条目集合指定组织单位名称。
( 2.5.4.11.1 NAME 'c-ou' SUP ou COLLECTIVE )
（2.5.4.11.1名称“c-ou”辅助ou集体）
The c-PostalAddress attribute type specifies a postal address for a collection of entries.
c-PostalAddress属性类型指定条目的集合的邮政地址。
( 2.5.4.16.1 NAME 'c-PostalAddress' SUP postalAddress COLLECTIVE )
（2.5.4.16.1名称“c-邮资”辅助邮资集体）
The c-PostalCode attribute type specifies a postal code for a collection of entries.
c-PostalCode属性类型指定条目的集合的邮政编码。
( 2.5.4.17.1 NAME 'c-PostalCode' SUP postalCode COLLECTIVE )
（2.5.4.17.1名称“c-PostalCode”辅助PostalCode集合）
The c-PostOfficeBox attribute type specifies a post office box for a collection of entries.
c-PostOfficeBox属性类型为条目集合指定邮局邮箱。
( 2.5.4.18.1 NAME 'c-PostOfficeBox' SUP postOfficeBox COLLECTIVE )
（2.5.4.18.1名称“c-邮政信箱”辅助邮政信箱集合）
The c-PhysicalDeliveryOfficeName attribute type specifies a physical delivery office name for a collection of entries.
c-PhysicalDeliveryOfficeName属性类型为条目集合指定一个物理传递办公室名称。
( 2.5.4.19.1 NAME 'c-PhysicalDeliveryOfficeName' SUP physicalDeliveryOfficeName COLLECTIVE )
（2.5.4.19.1名称“c-PhysicalDeliveryOfficeName”SUP PhysicalDeliveryOfficeName集合）
The c-TelephoneNumber attribute type specifies a telephone number for a collection of entries.
c-TelephoneNumber属性类型为条目集合指定电话号码。
( 2.5.4.20.1 NAME 'c-TelephoneNumber' SUP telephoneNumber COLLECTIVE )
（2.5.4.20.1名称“c-电话号码”辅助电话号码集合）
The c-TelexNumber attribute type specifies a telex number for a collection of entries.
c-TelexNumber属性类型为条目集合指定一个电传号码。
( 2.5.4.21.1 NAME 'c-TelexNumber' SUP telexNumber COLLECTIVE )
（2.5.4.21.1名称“c-电传号码”辅助电传号码集合）
The c-FacsimileTelephoneNumber attribute type specifies a facsimile telephone number for a collection of entries.
c-FacsimileTelephoneNumber属性类型为条目集合指定传真电话号码。
( 2.5.4.23.1 NAME 'c-FacsimileTelephoneNumber'
（2.5.4.23.1名称“c-FacsimileTelephoneNumber”
SUP facsimileTelephoneNumber COLLECTIVE )
副传真员（电话号码集体）
The c-InternationalISDNNumber attribute type specifies an international ISDN number for a collection of entries.
c-InternationalISDN编号属性类型为条目集合指定国际ISDN编号。
( 2.5.4.25.1 NAME 'c-InternationalISDNNumber' SUP internationalISDNNumber COLLECTIVE )
（2.5.4.25.1名称“c-InternationalISDNNumber”SUP InternationalISDNNumber集合）
Collective attributes, like other attributes, are subject to access control restrictions and other administrative policy. Generally speaking, collective attributes accessed via an entry in a collection are governed by rules restricting access to attributes of that entry. And collective attributes access via a subentry are governed by rules restricting access to attributes of that subentry. However, as LDAP does not have a standard access model, the particulars of each server's access control system may differ.
集合属性与其他属性一样，受访问控制限制和其他管理策略的约束。一般来说，通过集合中的条目访问的集合属性受限制访问该条目属性的规则控制。通过子项访问的集合属性由限制访问该子项属性的规则控制。但是，由于LDAP没有标准的访问模型，因此每个服务器的访问控制系统的细节可能会有所不同。
General LDAP security considerations [RFC3377] also apply.
一般LDAP安全注意事项[RFC3377]也适用。
The IANA has registered the LDAP descriptors [RFC3383] defined in this technical specification. The following registration template is suggested:
IANA已注册了本技术规范中定义的LDAP描述符[RFC3383]。建议使用以下注册模板：
Subject: Request for LDAP Descriptor Registration Descriptor see comments Object Identifier: see comment Person & email address to contact for further information: Kurt Zeilenga <kurt@OpenLDAP.org> Usage: see comment Specification: RFC3671 Author/Change Controller: IESG Comments:
主题：请求LDAP描述符注册描述符请参阅注释对象标识符：请参阅注释联系人和电子邮件地址以获取更多信息：Kurt Zeilenga<kurt@OpenLDAP.org>用法：请参阅注释规范：RFC3671作者/更改控制器：IESG注释：
NAME Type OID
------------------------ ---- -----------------
c-FacsimileTelephoneNumber A 2.5.4.23.1
c-InternationalISDNNumber A 2.5.4.25.1
c-PhysicalDeliveryOffice A 2.5.4.19.1
c-PostOfficeBox A 2.5.4.18.1
c-PostalAddress A 2.5.4.16.1
c-PostalCode A 2.5.4.17.1
c-TelephoneNumber A 2.5.4.20.1
c-TelexNumber A 2.5.4.21.1
c-l A 2.5.4.7.1
c-o A 2.5.4.10.1
c-ou A 2.5.4.11.1
c-st A 2.5.4.8.1
c-street A 2.5.4.9.1
collectiveAttributeSubentries A 2.5.18.12
collectiveAttributeSubentry O 2.5.17.2
collectiveExclusions A 2.5.18.7
NAME Type OID
------------------------ ---- -----------------
c-FacsimileTelephoneNumber A 2.5.4.23.1
c-InternationalISDNNumber A 2.5.4.25.1
c-PhysicalDeliveryOffice A 2.5.4.19.1
c-PostOfficeBox A 2.5.4.18.1
c-PostalAddress A 2.5.4.16.1
c-PostalCode A 2.5.4.17.1
c-TelephoneNumber A 2.5.4.20.1
c-TelexNumber A 2.5.4.21.1
c-l A 2.5.4.7.1
c-o A 2.5.4.10.1
c-ou A 2.5.4.11.1
c-st A 2.5.4.8.1
c-street A 2.5.4.9.1
collectiveAttributeSubentries A 2.5.18.12
collectiveAttributeSubentry O 2.5.17.2
collectiveExclusions A 2.5.18.7
where Type A is Attribute and Type O is ObjectClass.
其中，类型A是属性，类型O是对象类。
The Object Identifiers used in this document were assigned by the ISO/IEC Joint Technical Committee 1 - Subcommittee 6 to identify elements of X.500 schema [X.520]. This document make no OID assignments, it only provides LDAP schema descriptions with existing elements of X.500 schema.
本文件中使用的对象标识符由ISO/IEC联合技术委员会1-第6小组委员会分配，以识别X.500模式的元素[X.520]。本文档不进行OID分配，只提供LDAP模式描述和X.500模式的现有元素。
The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat.
IETF对可能声称与本文件所述技术的实施或使用有关的任何知识产权或其他权利的有效性或范围，或此类权利下的任何许可可能或可能不可用的程度，不采取任何立场；它也不表示它已作出任何努力来确定任何此类权利。有关IETF在标准跟踪和标准相关文件中权利的程序信息，请参见BCP-11。可从IETF秘书处获得可供发布的权利声明副本和任何许可证保证，或本规范实施者或用户试图获得使用此类专有权利的一般许可证或许可的结果。
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director.
IETF邀请任何相关方提请其注意任何版权、专利或专利申请，或其他可能涉及实施本标准所需技术的专有权利。请将信息发送给IETF执行董事。
This document is based upon the ITU Recommendations for the Directory [X.501][X.520].
本文件基于国际电联对目录[X.501][X.520]的建议。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory Access Protocol (v3)", RFC 2251, December 1997.
[RFC2251]Wahl，M.，Howes，T.和S.Kille，“轻量级目录访问协议（v3）”，RFC 2251，1997年12月。
[RFC2252] Wahl, M., Coulbeck, A., Howes, T. and S. Kille, "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997.
[RFC2252]Wahl，M.，Coulbeck，A.，Howes，T.和S.Kille，“轻量级目录访问协议（v3）：属性语法定义”，RFC2252，1997年12月。
[RFC2256] Wahl, M., "A Summary of the X.500(96) User Schema for use with LDAPv3", RFC 2256, December 1997.
[RFC2256]Wahl，M.，“用于LDAPv3的X.500（96）用户模式摘要”，RFC 2256，1997年12月。
[RFC3377] Hodges, J. and R. L. Morgan, "Lightweight Directory Access Protocol (v3): Technical Specification", RFC 3377, September 2002.
[RFC3377]Hodges，J.和R.L.Morgan，“轻量级目录访问协议（v3）：技术规范”，RFC 3377，2002年9月。
[RFC3383] Zeilenga, K., "Internet Assigned Numbers Authority (IANA) Considerations for the Lightweight Directory Access Protocol (LDAP)", BCP 64, RFC 3383, September 2002.
[RFC3383]Zeilenga，K.，“轻量级目录访问协议（LDAP）的互联网分配号码管理局（IANA）注意事项”，BCP 64，RFC 3383，2002年9月。
[RFC3672] Zeilenga, K. and S. Legg, "Subentries in Lightweight Directory Access Protocol (LDAP)", RFC 3672, December 2003.
[RFC3672]Zeilenga，K.和S.Legg，“轻量级目录访问协议（LDAP）中的子项”，RFC 3672，2003年12月。
[X.501] "The Directory: Models", ITU-T Recommendation X.501, 1993.
[X.501]“目录：模型”，ITU-T建议X.501，1993年。
[X.500] "The Directory: Overview of Concepts, Models", ITU-T Recommendation X.500, 1993.
[X.500]“目录：概念、模型概述”，ITU-T建议X.500，1993年。
[X.520] "The Directory: Selected Attribute Types", ITU-T Recommendation X.520, 1993.
[X.520]“目录：选定的属性类型”，ITU-T建议X.520，1993年。
Kurt D. Zeilenga OpenLDAP Foundation
库尔特D.Zeeliga OpenLDAP基金会
EMail: Kurt@OpenLDAP.org
EMail: Kurt@OpenLDAP.org
Copyright (C) The Internet Society (2003). All Rights Reserved.
版权所有（C）互联网协会（2003年）。版权所有。
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
本文件及其译本可复制并提供给他人，对其进行评论或解释或协助其实施的衍生作品可全部或部分编制、复制、出版和分发，不受任何限制，前提是上述版权声明和本段包含在所有此类副本和衍生作品中。但是，不得以任何方式修改本文件本身，例如删除版权通知或对互联网协会或其他互联网组织的引用，除非出于制定互联网标准的需要，在这种情况下，必须遵循互联网标准过程中定义的版权程序，或根据需要将其翻译成英语以外的其他语言。
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assignees.
上述授予的有限许可是永久性的，互联网协会或其继承人或受让人不会撤销。
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件和其中包含的信息是按“原样”提供的，互联网协会和互联网工程任务组否认所有明示或暗示的保证，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Acknowledgement
确认
Funding for the RFC Editor function is currently provided by the Internet Society.
RFC编辑功能的资金目前由互联网协会提供。