Network Working Group K. Zeilenga
Request for Comments: 4512 OpenLDAP Foundation
Obsoletes: 2251, 2252, 2256, 3674 June 2006
Category: Standards Track
Network Working Group K. Zeilenga
Request for Comments: 4512 OpenLDAP Foundation
Obsoletes: 2251, 2252, 2256, 3674 June 2006
Category: Standards Track
Lightweight Directory Access Protocol (LDAP): Directory Information Models
轻量级目录访问协议（LDAP）：目录信息模型
Status of This Memo
关于下段备忘
This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.
本文件规定了互联网社区的互联网标准跟踪协议，并要求进行讨论和提出改进建议。有关本协议的标准化状态和状态，请参考当前版本的“互联网官方协议标准”（STD 1）。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (2006).
版权所有（C）互联网协会（2006年）。
Abstract
摘要
The Lightweight Directory Access Protocol (LDAP) is an Internet protocol for accessing distributed directory services that act in accordance with X.500 data and service models. This document describes the X.500 Directory Information Models, as used in LDAP.
轻量级目录访问协议（LDAP）是一种Internet协议，用于访问根据X.500数据和服务模型运行的分布式目录服务。本文档描述了LDAP中使用的X.500目录信息模型。
Table of Contents
目录
1. Introduction ....................................................3
1.1. Relationship to Other LDAP Specifications ..................3
1.2. Relationship to X.501 ......................................4
1.3. Conventions ................................................4
1.4. Common ABNF Productions ....................................4
2. Model of Directory User Information .............................6
2.1. The Directory Information Tree .............................7
2.2. Structure of an Entry ......................................7
2.3. Naming of Entries ..........................................8
2.4. Object Classes .............................................9
2.5. Attribute Descriptions ....................................12
2.6. Alias Entries .............................................16
3. Directory Administrative and Operational Information ...........17
3.1. Subtrees ..................................................17
3.2. Subentries ................................................18
3.3. The 'objectClass' attribute ...............................18
3.4. Operational Attributes ....................................19
4. Directory Schema ...............................................22
4.1. Schema Definitions ........................................23
4.2. Subschema Subentries ......................................32
4.3. 'extensibleObject' object class ...........................35
4.4. Subschema Discovery .......................................35
5. DSA (Server) Informational Model ...............................36
5.1. Server-Specific Data Requirements .........................36
6. Other Considerations ...........................................40
6.1. Preservation of User Information ..........................40
6.2. Short Names ...............................................41
6.3. Cache and Shadowing .......................................41
7. Implementation Guidelines ......................................42
7.1. Server Guidelines .........................................42
7.2. Client Guidelines .........................................42
8. Security Considerations ........................................43
9. IANA Considerations ............................................43
10. Acknowledgements ..............................................44
11. Normative References ..........................................45
Appendix A. Changes ...............................................47
A.1. Changes to RFC 2251 .......................................47
A.2. Changes to RFC 2252 .......................................49
A.3. Changes to RFC 2256 .......................................50
A.4. Changes to RFC 3674 .......................................51
1. Introduction ....................................................3
1.1. Relationship to Other LDAP Specifications ..................3
1.2. Relationship to X.501 ......................................4
1.3. Conventions ................................................4
1.4. Common ABNF Productions ....................................4
2. Model of Directory User Information .............................6
2.1. The Directory Information Tree .............................7
2.2. Structure of an Entry ......................................7
2.3. Naming of Entries ..........................................8
2.4. Object Classes .............................................9
2.5. Attribute Descriptions ....................................12
2.6. Alias Entries .............................................16
3. Directory Administrative and Operational Information ...........17
3.1. Subtrees ..................................................17
3.2. Subentries ................................................18
3.3. The 'objectClass' attribute ...............................18
3.4. Operational Attributes ....................................19
4. Directory Schema ...............................................22
4.1. Schema Definitions ........................................23
4.2. Subschema Subentries ......................................32
4.3. 'extensibleObject' object class ...........................35
4.4. Subschema Discovery .......................................35
5. DSA (Server) Informational Model ...............................36
5.1. Server-Specific Data Requirements .........................36
6. Other Considerations ...........................................40
6.1. Preservation of User Information ..........................40
6.2. Short Names ...............................................41
6.3. Cache and Shadowing .......................................41
7. Implementation Guidelines ......................................42
7.1. Server Guidelines .........................................42
7.2. Client Guidelines .........................................42
8. Security Considerations ........................................43
9. IANA Considerations ............................................43
10. Acknowledgements ..............................................44
11. Normative References ..........................................45
Appendix A. Changes ...............................................47
A.1. Changes to RFC 2251 .......................................47
A.2. Changes to RFC 2252 .......................................49
A.3. Changes to RFC 2256 .......................................50
A.4. Changes to RFC 3674 .......................................51
This document discusses the X.500 Directory Information Models [X.501], as used by the Lightweight Directory Access Protocol (LDAP) [RFC4510].
本文档讨论轻量级目录访问协议（LDAP）[RFC4510]使用的X.500目录信息模型[X.501]。
The Directory is "a collection of open systems cooperating to provide directory services" [X.500]. The information held in the Directory is collectively known as the Directory Information Base (DIB). A Directory user, which may be a human or other entity, accesses the Directory through a client (or Directory User Agent (DUA)). The client, on behalf of the directory user, interacts with one or more servers (or Directory System Agents (DSA)). A server holds a fragment of the DIB.
该目录是“合作提供目录服务的开放系统集合”[X.500]。目录中保存的信息统称为目录信息库（DIB）。目录用户可以是人或其他实体，通过客户端（或目录用户代理（DUA））访问目录。客户端代表目录用户与一个或多个服务器（或目录系统代理（DSA））交互。服务器保存DIB的一个片段。
The DIB contains two classes of information:
DIB包含两类信息：
1) user information (e.g., information provided and administrated by users). Section 2 describes the Model of User Information.
1) 用户信息（例如，由用户提供和管理的信息）。第2节描述了用户信息的模型。
2) administrative and operational information (e.g., information used to administer and/or operate the directory). Section 3 describes the model of Directory Administrative and Operational Information.
2) 管理和操作信息（例如，用于管理和/或操作目录的信息）。第3节描述了目录管理和操作信息的模型。
These two models, referred to as the generic Directory Information Models, describe how information is represented in the Directory. These generic models provide a framework for other information models. Section 4 discusses the subschema information model and subschema discovery. Section 5 discusses the DSA (Server) Informational Model.
这两个模型称为通用目录信息模型，描述了信息在目录中的表示方式。这些通用模型为其他信息模型提供了一个框架。第4节讨论子模式信息模型和子模式发现。第5节讨论了DSA（服务器）信息模型。
Other X.500 information models (such as access control distribution knowledge and replication knowledge information models) may be adapted for use in LDAP. Specification of how these models apply to LDAP is left to future documents.
其他X.500信息模型（如访问控制分发知识和复制知识信息模型）可适用于LDAP。关于这些模型如何应用于LDAP的规范将留待将来的文档进行说明。
This document is a integral part of the LDAP technical specification [RFC4510], which obsoletes the previously defined LDAP technical specification, RFC 3377, in its entirety.
本文档是LDAP技术规范[RFC4510]不可分割的一部分，该规范完全废除了先前定义的LDAP技术规范RFC 3377。
This document obsoletes RFC 2251, Sections 3.2 and 3.4, as well as portions of Sections 4 and 6. Appendix A.1 summarizes changes to these sections. The remainder of RFC 2251 is obsoleted by the [RFC4511], [RFC4513], and [RFC4510] documents.
本文件废除了RFC 2251第3.2节和第3.4节以及第4节和第6节的部分内容。附录A.1总结了这些章节的变更。[RFC4511]、[RFC4513]和[RFC4510]文件废弃了RFC 2251的其余部分。
This document obsoletes RFC 2252, Sections 4, 5, and 7. Appendix A.2 summarizes changes to these sections. The remainder of RFC 2252 is obsoleted by [RFC4517].
本文件废除了RFC 2252第4、5和7节。附录A.2总结了这些章节的变更。RFC 2252的其余部分由[RFC4517]淘汰。
This document obsoletes RFC 2256, Sections 5.1, 5.2, 7.1, and 7.2. Appendix A.3 summarizes changes to these sections. The remainder of RFC 2256 is obsoleted by [RFC4519] and [RFC4517].
本文件废除了RFC 2256第5.1、5.2、7.1和7.2节。附录A.3总结了这些章节的变更。RFC 2256的其余部分被[RFC4519]和[RFC4517]淘汰。
This document obsoletes RFC 3674 in its entirety. Appendix A.4 summarizes changes since RFC 3674.
本文件完全废弃RFC 3674。附录A.4总结了自RFC 3674以来的变化。
This document includes material, with and without adaptation, from [X.501] as necessary to describe this protocol. These adaptations (and any other differences herein) apply to this protocol, and only this protocol.
本文件包括[X.501]中描述本协议所需的材料，包括经修改和未经修改的材料。这些修改（以及本文中的任何其他差异）适用于本协议，并且仅适用于本协议。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照BCP 14[RFC2119]中所述进行解释。
Schema definitions are provided using LDAP description formats (as defined in Section 4.1). Definitions provided here are formatted (line wrapped) for readability. Matching rules and LDAP syntaxes referenced in these definitions are specified in [RFC4517].
模式定义使用LDAP描述格式提供（如第4.1节所定义）。为了便于阅读，这里提供的定义是格式化的（换行）。[RFC4517]中指定了这些定义中引用的匹配规则和LDAP语法。
A number of syntaxes in this document are described using Augmented Backus-Naur Form (ABNF) [RFC4234]. These syntaxes (as well as a number of syntaxes defined in other documents) rely on the following common productions:
本文中的许多语法都是使用增广的巴科斯-诺尔形式（ABNF）[RFC4234]来描述的。这些语法（以及其他文档中定义的许多语法）依赖于以下常见产品：
keystring = leadkeychar *keychar
leadkeychar = ALPHA
keychar = ALPHA / DIGIT / HYPHEN
number = DIGIT / ( LDIGIT 1*DIGIT )
keystring = leadkeychar *keychar
leadkeychar = ALPHA
keychar = ALPHA / DIGIT / HYPHEN
number = DIGIT / ( LDIGIT 1*DIGIT )
ALPHA = %x41-5A / %x61-7A ; "A"-"Z" / "a"-"z"
DIGIT = %x30 / LDIGIT ; "0"-"9"
LDIGIT = %x31-39 ; "1"-"9"
HEX = DIGIT / %x41-46 / %x61-66 ; "0"-"9" / "A"-"F" / "a"-"f"
ALPHA = %x41-5A / %x61-7A ; "A"-"Z" / "a"-"z"
DIGIT = %x30 / LDIGIT ; "0"-"9"
LDIGIT = %x31-39 ; "1"-"9"
HEX = DIGIT / %x41-46 / %x61-66 ; "0"-"9" / "A"-"F" / "a"-"f"
SP = 1*SPACE ; one or more " "
WSP = 0*SPACE ; zero or more " "
SP = 1*SPACE ; one or more " "
WSP = 0*SPACE ; zero or more " "
NULL = %x00 ; null (0)
SPACE = %x20 ; space (" ")
DQUOTE = %x22 ; quote (""")
SHARP = %x23 ; octothorpe (or sharp sign) ("#")
DOLLAR = %x24 ; dollar sign ("$")
SQUOTE = %x27 ; single quote ("'")
LPAREN = %x28 ; left paren ("(")
RPAREN = %x29 ; right paren (")")
PLUS = %x2B ; plus sign ("+")
COMMA = %x2C ; comma (",")
HYPHEN = %x2D ; hyphen ("-")
DOT = %x2E ; period (".")
SEMI = %x3B ; semicolon (";")
LANGLE = %x3C ; left angle bracket ("<")
EQUALS = %x3D ; equals sign ("=")
RANGLE = %x3E ; right angle bracket (">")
ESC = %x5C ; backslash ("\")
USCORE = %x5F ; underscore ("_")
LCURLY = %x7B ; left curly brace "{"
RCURLY = %x7D ; right curly brace "}"
NULL = %x00 ; null (0)
SPACE = %x20 ; space (" ")
DQUOTE = %x22 ; quote (""")
SHARP = %x23 ; octothorpe (or sharp sign) ("#")
DOLLAR = %x24 ; dollar sign ("$")
SQUOTE = %x27 ; single quote ("'")
LPAREN = %x28 ; left paren ("(")
RPAREN = %x29 ; right paren (")")
PLUS = %x2B ; plus sign ("+")
COMMA = %x2C ; comma (",")
HYPHEN = %x2D ; hyphen ("-")
DOT = %x2E ; period (".")
SEMI = %x3B ; semicolon (";")
LANGLE = %x3C ; left angle bracket ("<")
EQUALS = %x3D ; equals sign ("=")
RANGLE = %x3E ; right angle bracket (">")
ESC = %x5C ; backslash ("\")
USCORE = %x5F ; underscore ("_")
LCURLY = %x7B ; left curly brace "{"
RCURLY = %x7D ; right curly brace "}"
; Any UTF-8 [RFC3629] encoded Unicode [Unicode] character
UTF8 = UTF1 / UTFMB
UTFMB = UTF2 / UTF3 / UTF4
UTF0 = %x80-BF
UTF1 = %x00-7F
UTF2 = %xC2-DF UTF0
UTF3 = %xE0 %xA0-BF UTF0 / %xE1-EC 2(UTF0) /
%xED %x80-9F UTF0 / %xEE-EF 2(UTF0)
UTF4 = %xF0 %x90-BF 2(UTF0) / %xF1-F3 3(UTF0) /
%xF4 %x80-8F 2(UTF0)
; Any UTF-8 [RFC3629] encoded Unicode [Unicode] character
UTF8 = UTF1 / UTFMB
UTFMB = UTF2 / UTF3 / UTF4
UTF0 = %x80-BF
UTF1 = %x00-7F
UTF2 = %xC2-DF UTF0
UTF3 = %xE0 %xA0-BF UTF0 / %xE1-EC 2(UTF0) /
%xED %x80-9F UTF0 / %xEE-EF 2(UTF0)
UTF4 = %xF0 %x90-BF 2(UTF0) / %xF1-F3 3(UTF0) /
%xF4 %x80-8F 2(UTF0)
OCTET = %x00-FF ; Any octet (8-bit data unit)
OCTET = %x00-FF ; Any octet (8-bit data unit)
Object identifiers (OIDs) [X.680] are represented in LDAP using a dot-decimal format conforming to the ABNF:
对象标识符（OID）[X.680]在LDAP中使用符合ABNF的点十进制格式表示：
numericoid = number 1*( DOT number )
numericoid=编号1*（点编号）
Short names, also known as descriptors, are used as more readable aliases for object identifiers. Short names are case insensitive and conform to the ABNF:
短名称（也称为描述符）用作对象标识符的更可读别名。短名称不区分大小写，并符合ABNF：
descr = keystring
descr = keystring
Where either an object identifier or a short name may be specified, the following production is used:
如果可以指定对象标识符或短名称，则使用以下产品：
oid = descr / numericoid
oid = descr / numericoid
While the <descr> form is generally preferred when the usage is restricted to short names referring to object identifiers that identify like kinds of objects (e.g., attribute type descriptions, matching rule descriptions, object class descriptions), the <numericoid> form should be used when the object identifiers may identify multiple kinds of objects or when an unambiguous short name (descriptor) is not available.
而<descr>形式通常是首选的，当使用仅限于指向标识类似类型对象的对象标识符（例如，属性类型描述、匹配规则描述、对象类描述）的短名称时，当对象标识符可能识别多种类型的对象或当没有明确的短名称（描述符）时，应使用<numericoid>形式。
Implementations SHOULD treat short names (descriptors) used in an ambiguous manner (as discussed above) as unrecognized.
实现应该将以不明确的方式（如上所述）使用的短名称（描述符）视为无法识别。
Short Names (descriptors) are discussed further in Section 6.2.
第6.2节将进一步讨论短名称（描述符）。
As [X.501] states:
正如[X.501]所述：
The purpose of the Directory is to hold, and provide access to, information about objects of interest (objects) in some 'world'. An object can be anything which is identifiable (can be named).
目录的目的是保存并提供对某些“世界”中感兴趣对象（对象）的信息的访问。对象可以是任何可识别（可命名）的对象。
An object class is an identified family of objects, or conceivable objects, which share certain characteristics. Every object belongs to at least one class. An object class may be a subclass of other object classes, in which case the members of the former class, the subclass, are also considered to be members of the latter classes, the superclasses. There may be subclasses of subclasses, etc., to an arbitrary depth.
对象类是一个已识别的对象族，或具有某些特征的可想象对象。每个对象至少属于一个类。对象类可以是其他对象类的子类，在这种情况下，前一个类（子类）的成员也被认为是后一个类（超类）的成员。可能存在子类的子类，等等，达到任意深度。
A directory entry, a named collection of information, is the basic unit of information held in the Directory. There are multiple kinds of directory entries.
目录项是一个命名的信息集合，是目录中信息的基本单位。有多种目录条目。
An object entry represents a particular object. An alias entry provides alternative naming. A subentry holds administrative and/or operational information.
对象条目表示特定对象。别名条目提供替代命名。子条目保存管理和/或操作信息。
The set of entries representing the DIB are organized hierarchically in a tree structure known as the Directory Information Tree (DIT).
代表DIB的一组条目以称为目录信息树（DIT）的树结构分层组织。
Section 2.1 describes the Directory Information Tree. Section 2.2 discusses the structure of entries. Section 2.3 discusses naming of entries.
第2.1节描述了目录信息树。第2.2节讨论了条目的结构。第2.3节讨论了条目的命名。
Section 2.4 discusses object classes. Section 2.5 discusses attribute descriptions. Section 2.6 discusses alias entries.
第2.4节讨论对象类。第2.5节讨论属性描述。第2.6节讨论别名条目。
As noted above, the DIB is composed of a set of entries organized hierarchically in a tree structure known as the Directory Information Tree (DIT); specifically, a tree where vertices are the entries.
如上所述，DIB由以称为目录信息树（Directory Information tree，DIT）的树结构分层组织的一组条目组成；具体来说，是一棵树，其中顶点是条目。
The arcs between vertices define relations between entries. If an arc exists from X to Y, then the entry at X is the immediate superior of Y, and Y is the immediate subordinate of X. An entry's superiors are the entry's immediate superior and its superiors. An entry's subordinates are all of its immediate subordinates and their subordinates.
顶点之间的圆弧定义条目之间的关系。如果从X到Y存在弧，则X处的条目是Y的直接上级，Y是X的直接下级。条目的上级是条目的直接上级及其上级。条目的下属是其所有直接下属及其下属。
Similarly, the superior/subordinate relationship between object entries can be used to derive a relation between the objects they represent. DIT structure rules can be used to govern relationships between objects.
类似地，对象条目之间的上级/下级关系可用于导出它们所表示的对象之间的关系。DIT结构规则可用于管理对象之间的关系。
Note: An entry's immediate superior is also known as the entry's parent, and an entry's immediate subordinate is also known as the entry's child. Entries that have the same parent are known as siblings.
注意：条目的直接上级也称为条目的父级，条目的直接下级也称为条目的子级。具有相同父项的条目称为同级。
An entry consists of a set of attributes that hold information about the object that the entry represents. Some attributes represent user information and are called user attributes. Other attributes represent operational and/or administrative information and are called operational attributes.
条目由一组属性组成，这些属性保存有关该条目所表示对象的信息。有些属性表示用户信息，称为用户属性。其他属性表示操作和/或管理信息，称为操作属性。
An attribute is an attribute description (a type and zero or more options) with one or more associated values. An attribute is often referred to by its attribute description. For example, the 'givenName' attribute is the attribute that consists of the attribute description 'givenName' (the 'givenName' attribute type [RFC4519] and zero options) and one or more associated values.
属性是具有一个或多个关联值的属性描述（类型和零个或多个选项）。属性通常通过其属性描述来引用。例如，“givenName”属性是由属性描述“givenName”（“givenName”属性类型[RFC4519]和零选项）和一个或多个关联值组成的属性。
The attribute type governs whether the attribute can have multiple values, the syntax and matching rules used to construct and compare values of that attribute, and other functions. Options indicate subtypes and other functions.
属性类型控制属性是否可以有多个值、用于构造和比较该属性值的语法和匹配规则以及其他函数。选项指示子类型和其他函数。
Attribute values conform to the defined syntax of the attribute type.
属性值符合属性类型的定义语法。
No two values of an attribute may be equivalent. Two values are considered equivalent if and only if they would match according to the equality matching rule of the attribute type. Or, if the attribute type is defined with no equality matching rule, two values are equivalent if and only if they are identical. (See 2.5.1 for other restrictions.)
属性的任何两个值都不能相等。当且仅当两个值根据属性类型的相等匹配规则匹配时，才认为它们是等效的。或者，如果属性类型是在没有相等匹配规则的情况下定义的，则只有当且仅当两个值相同时，这两个值才是相等的。（其他限制见2.5.1。）
For example, a 'givenName' attribute can have more than one value, they must be Directory Strings, and they are case insensitive. A 'givenName' attribute cannot hold both "John" and "JOHN", as these are equivalent values per the equality matching rule of the attribute type.
例如，“givenName”属性可以有多个值，它们必须是目录字符串，并且不区分大小写。“givenName”属性不能同时包含“John”和“John”，因为根据属性类型的相等匹配规则，这两个值是等效的。
Additionally, no attribute is to have a value that is not equivalent to itself. For example, the 'givenName' attribute cannot have as a value a directory string that includes the REPLACEMENT CHARACTER (U+FFFD) code point, as matching involving that directory string is Undefined per this attribute's equality matching rule.
此外，任何属性都不能具有与自身不等价的值。例如，“givenName”属性不能将包含替换字符（U+FFFD）代码点的目录字符串作为值，因为根据该属性的相等匹配规则，涉及该目录字符串的匹配未定义。
When an attribute is used for naming of the entry, one and only one value of the attribute is used in forming the Relative Distinguished Name. This value is known as a distinguished value.
当一个属性用于条目的命名时，该属性的一个且只有一个值用于形成相对可分辨名称。此值称为可分辨值。
Each entry is named relative to its immediate superior. This relative name, known as its Relative Distinguished Name (RDN) [X.501], is composed of an unordered set of one or more attribute value assertions (AVA) consisting of an attribute description with zero options and an attribute value. These AVAs are chosen to match attribute values (each a distinguished value) of the entry.
每个条目都是相对于其直接上级命名的。该相对名称称为其相对可分辨名称（RDN）[X.501]，由一组无序的一个或多个属性值断言（AVA）组成，AVA由一个具有零选项的属性描述和一个属性值组成。选择这些AVA是为了匹配条目的属性值（每个属性值都是可分辨的值）。
An entry's relative distinguished name must be unique among all immediate subordinates of the entry's immediate superior (i.e., all siblings).
条目的相对可分辨名称在条目的直接上级的所有直接下属（即所有兄弟姐妹）中必须是唯一的。
The following are examples of string representations of RDNs [RFC4514]:
以下是RDN[RFC4514]的字符串表示示例：
UID=12345
OU=Engineering
CN=Kurt Zeilenga+L=Redwood Shores
UID=12345
OU=Engineering
CN=Kurt Zeilenga+L=Redwood Shores
The last is an example of a multi-valued RDN; that is, an RDN composed of multiple AVAs.
最后一个是多值RDN的示例；也就是说，由多个AVA组成的RDN。
An entry's fully qualified name, known as its Distinguished Name (DN) [X.501], is the concatenation of its RDN and its immediate superior's DN. A Distinguished Name unambiguously refers to an entry in the tree. The following are examples of string representations of DNs [RFC4514]:
条目的完全限定名，称为其可分辨名称（DN）[X.501]，是其RDN和直接上级DN的串联。可分辨名称明确地引用树中的条目。以下是DNs[RFC4514]的字符串表示的示例：
UID=nobody@example.com,DC=example,DC=com
CN=John Smith,OU=Sales,O=ACME Limited,L=Moab,ST=Utah,C=US
UID=nobody@example.com,DC=example,DC=com
CN=John Smith,OU=Sales,O=ACME Limited,L=Moab,ST=Utah,C=US
An alias, or alias name, is "an name for an object, provided by the use of alias entries" [X.501]. Alias entries are described in Section 2.6.
别名或别名是“通过使用别名条目提供的对象名称”[X.501]。第2.6节介绍了别名条目。
An object class is "an identified family of objects (or conceivable objects) that share certain characteristics" [X.501].
对象类是“共享某些特征的已识别对象（或可想象对象）族”[X.501]。
As defined in [X.501]:
如[X.501]中所定义：
Object classes are used in the Directory for a number of purposes:
目录中的对象类用于多种目的：
- describing and categorizing objects and the entries that correspond to these objects;
- 描述和分类对象以及与这些对象对应的条目；
- where appropriate, controlling the operation of the Directory;
- 在适当情况下，控制目录的运行；
- regulating, in conjunction with DIT structure rule specifications, the position of entries in the DIT;
- 与DIT结构规则规范一起，规范DIT中条目的位置；
- regulating, in conjunction with DIT content rule specifications, the attributes that are contained in entries;
- 结合DIT内容规则规范，规范条目中包含的属性；
- identifying classes of entry that are to be associated with a particular policy by the appropriate administrative authority.
- 确定将由适当的管理机构与特定策略关联的条目类别。
An object class (a subclass) may be derived from an object class (its direct superclass) which is itself derived from an even more generic object class. For structural object classes, this process stops at the most generic object class, 'top' (defined in Section 2.4.1). An ordered set of superclasses up to the most superior object class of an object class is its superclass chain.
一个对象类（一个子类）可以从一个对象类（它的直接超类）派生出来，而对象类本身就是从一个更通用的对象类派生出来的。对于结构对象类，此过程在最通用的对象类“top”（定义见第2.4.1节）处停止。一个有序的超类集合直到一个对象类中最高级的对象类就是它的超类链。
An object class may be derived from two or more direct superclasses (superclasses not part of the same superclass chain). This feature of subclassing is termed multiple inheritance.
一个对象类可以派生自两个或多个直接超类（超类不是同一超类链的一部分）。子类化的这个特性称为多重继承。
Each object class identifies the set of attributes required to be present in entries belonging to the class and the set of attributes allowed to be present in entries belonging to the class. As an entry of a class must meet the requirements of each class it belongs to, it can be said that an object class inherits the sets of allowed and required attributes from its superclasses. A subclass can identify an attribute allowed by its superclass as being required. If an attribute is a member of both sets, it is required to be present.
每个对象类标识需要在属于该类的条目中出现的属性集，以及允许在属于该类的条目中出现的属性集。由于类的条目必须满足其所属的每个类的要求，因此可以说对象类从其超类继承了允许的和必需的属性集。子类可以将其超类允许的属性标识为必需的属性。如果一个属性是两个集合的成员，则要求该属性存在。
Each object class is defined to be one of three kinds of object classes: Abstract, Structural, or Auxiliary.
每个对象类定义为三种对象类之一：抽象、结构或辅助。
Each object class is identified by an object identifier (OID) and, optionally, one or more short names (descriptors).
每个对象类由对象标识符（OID）和一个或多个短名称（描述符）标识。
An abstract object class, as the name implies, provides a base of characteristics from which other object classes can be defined to inherit from. An entry cannot belong to an abstract object class unless it belongs to a structural or auxiliary class that inherits from that abstract class.
顾名思义，抽象对象类提供了一组特征，其他对象类可以从这些特征中定义继承。条目不能属于抽象对象类，除非它属于从该抽象类继承的结构类或辅助类。
Abstract object classes cannot derive from structural or auxiliary object classes.
抽象对象类不能从结构或辅助对象类派生。
All structural object classes derive (directly or indirectly) from the 'top' abstract object class. Auxiliary object classes do not necessarily derive from 'top'.
所有结构对象类（直接或间接）都派生自“top”抽象对象类。辅助对象类不一定从“top”派生。
The following is the object class definition (see Section 4.1.1) for the 'top' object class:
以下是“顶级”对象类的对象类定义（见第4.1.1节）：
( 2.5.6.0 NAME 'top' ABSTRACT MUST objectClass )
（2.5.6.0名称“top”抽象必须为objectClass）
All entries belong to the 'top' abstract object class.
所有条目都属于“top”抽象对象类。
As stated in [X.501]:
如[X.501]所述：
An object class defined for use in the structural specification of the DIT is termed a structural object class. Structural object classes are used in the definition of the structure of the names of the objects for compliant entries.
定义用于DIT结构规范的对象类称为结构对象类。结构对象类用于定义兼容条目的对象名称的结构。
An object or alias entry is characterized by precisely one structural object class superclass chain which has a single structural object class as the most subordinate object class. This structural object class is referred to as the structural object class of the entry.
一个对象或别名条目的特征就是一个结构对象类超类链，该超类链有一个结构对象类作为最下级的对象类。此结构对象类称为条目的结构对象类。
Structural object classes are related to associated entries:
结构对象类与关联的条目相关：
- an entry conforming to a structural object class shall represent the real-world object constrained by the object class;
- 符合结构对象类的条目应表示受对象类约束的真实世界对象；
- DIT structure rules only refer to structural object classes; the structural object class of an entry is used to specify the position of the entry in the DIT;
- DIT结构规则仅指结构对象类；条目的结构对象类用于指定条目在DIT中的位置；
- the structural object class of an entry is used, along with an associated DIT content rule, to control the content of an entry.
- 条目的结构对象类与关联的DIT内容规则一起用于控制条目的内容。
The structural object class of an entry shall not be changed.
不得更改入口的结构对象类别。
Each structural object class is a (direct or indirect) subclass of the 'top' abstract object class.
每个结构对象类都是“top”抽象对象类的（直接或间接）子类。
Structural object classes cannot subclass auxiliary object classes.
结构对象类不能作为辅助对象类的子类。
Each entry is said to belong to its structural object class as well as all classes in its structural object class's superclass chain.
据说每个条目都属于其结构对象类以及其结构对象类的超类链中的所有类。
Auxiliary object classes are used to augment the characteristics of entries. They are commonly used to augment the sets of attributes required and allowed to be present in an entry. They can be used to describe entries or classes of entries.
辅助对象类用于增强条目的特征。它们通常用于增加条目中所需和允许的属性集。它们可用于描述条目或条目类别。
Auxiliary object classes cannot subclass structural object classes.
辅助对象类不能对结构对象类进行子类化。
An entry can belong to any subset of the set of auxiliary object classes allowed by the DIT content rule associated with the structural object class of the entry. If no DIT content rule is associated with the structural object class of the entry, the entry cannot belong to any auxiliary object class.
条目可以属于与条目的结构对象类关联的DIT内容规则所允许的辅助对象类集合的任何子集。如果没有与条目的结构对象类关联的DIT内容规则，则该条目不能属于任何辅助对象类。
The set of auxiliary object classes that an entry belongs to can change over time.
条目所属的辅助对象类集可以随时间变化。
An attribute description is composed of an attribute type (see Section 2.5.1) and a set of zero or more attribute options (see Section 2.5.2).
属性描述由属性类型（见第2.5.1节）和一组零个或多个属性选项（见第2.5.2节）组成。
An attribute description is represented by the ABNF:
属性描述由ABNF表示：
attributedescription = attributetype options
attributetype = oid
options = *( SEMI option )
option = 1*keychar
attributedescription = attributetype options
attributetype = oid
options = *( SEMI option )
option = 1*keychar
where <attributetype> identifies the attribute type and each <option> identifies an attribute option. Both <attributetype> and <option> productions are case insensitive. The order in which <option>s appear is irrelevant. That is, any two <attributedescription>s that consist of the same <attributetype> and same set of <option>s are equivalent.
其中，<attributetype>标识属性类型，每个<option>标识属性选项。<attributetype>和<option>产品都不区分大小写。<option>s的出现顺序无关紧要。也就是说，由相同的<attributetype>和相同的<option>组成的任何两个<attributedescription>都是等效的。
Examples of valid attribute descriptions:
有效属性描述的示例：
2.5.4.0 cn;lang-de;lang-en owner
2.5.4.0 cn；朗德；朗恩老板
An attribute description with an unrecognized attribute type is to be treated as unrecognized. Servers SHALL treat an attribute description with an unrecognized attribute option as unrecognized. Clients MAY treat an unrecognized attribute option as a tagging option (see Section 2.5.2.1).
属性类型无法识别的属性描述将被视为无法识别。服务器应将具有未识别属性选项的属性描述视为未识别。客户可以将无法识别的属性选项视为标记选项（参见第2.5.2.1节）。
All attributes of an entry must have distinct attribute descriptions.
条目的所有属性都必须具有不同的属性描述。
An attribute type governs whether the attribute can have multiple values, the syntax and matching rules used to construct and compare values of that attribute, and other functions.
属性类型控制属性是否可以有多个值、用于构造和比较该属性值的语法和匹配规则以及其他函数。
If no equality matching is specified for the attribute type:
如果未为属性类型指定相等匹配：
- the attribute (of the type) cannot be used for naming; - when adding the attribute (or replacing all values), no two values may be equivalent (see 2.2); - individual values of a multi-valued attribute are not to be independently added or deleted; - attribute value assertions (such as matching in search filters and comparisons) using values of such a type cannot be performed.
- （类型的）属性不能用于命名；-添加属性（或替换所有值）时，任何两个值都不能相等（请参见2.2）；-不得单独添加或删除多值属性的单个值；-无法使用此类值执行属性值断言（例如搜索筛选器和比较中的匹配）。
Otherwise, the specified equality matching rule is to be used to evaluate attribute value assertions concerning the attribute type. The specified equality rule is to be transitive and commutative.
否则，指定的相等匹配规则将用于评估有关属性类型的属性值断言。指定的相等规则是可传递和可交换的。
The attribute type indicates whether the attribute is a user attribute or an operational attribute. If operational, the attribute type indicates the operational usage and whether or not the attribute is modifiable by users. Operational attributes are discussed in Section 3.4.
属性类型指示该属性是用户属性还是操作属性。如果是可操作的，则属性类型指示操作用途以及该属性是否可由用户修改。第3.4节讨论了操作属性。
An attribute type (a subtype) may derive from a more generic attribute type (a direct supertype). The following restrictions apply to subtyping:
属性类型（子类型）可以派生自更通用的属性类型（直接超类型）。以下限制适用于子类型：
- a subtype must have the same usage as its direct supertype, - a subtype's syntax must be the same, or a refinement of, its supertype's syntax, and - a subtype must be collective [RFC3671] if its supertype is collective.
- 子类型必须与其直接超类型具有相同的用法，-子类型的语法必须与其超类型的语法相同，或是其语法的细化，-如果子类型的超类型为集合，则子类型必须为集合[RFC3671]。
An attribute description consisting of a subtype and no options is said to be the direct description subtype of the attribute description consisting of the subtype's direct supertype and no options.
由子类型和无选项组成的属性描述称为由子类型的直接超类型和无选项组成的属性描述的直接描述子类型。
Each attribute type is identified by an object identifier (OID) and, optionally, one or more short names (descriptors).
每个属性类型由对象标识符（OID）和一个或多个短名称（描述符）标识。
There are multiple kinds of attribute description options. The LDAP technical specification details one kind: tagging options.
有多种类型的属性描述选项。LDAP技术规范详细介绍了一种：标记选项。
Not all options can be associated with attributes held in the directory. Tagging options can be.
并非所有选项都可以与目录中的属性关联。可以选择标记选项。
Not all options can be used in conjunction with all attribute types. In such cases, the attribute description is to be treated as unrecognized.
并非所有选项都可以与所有属性类型一起使用。在这种情况下，属性描述将被视为无法识别。
An attribute description that contains mutually exclusive options shall be treated as unrecognized. That is, "cn;x-bar;x-foo", where "x-foo" and "x-bar" are mutually exclusive, is to be treated as unrecognized.
包含互斥选项的属性描述应视为无法识别。也就是说，“cn；x-bar；x-foo”，其中“x-foo”和“x-bar”是互斥的，将被视为未识别的。
Other kinds of options may be specified in future documents. These documents must detail how new kinds of options they define relate to tagging options. In particular, these documents must detail whether or not new kinds of options can be associated with attributes held in the directory, how new kinds of options affect transfer of attribute values, and how new kinds of options are treated in attribute description hierarchies.
其他类型的选项可能会在将来的文档中指定。这些文档必须详细说明它们定义的新选项类型与标记选项的关系。特别是，这些文档必须详细说明新类型的选项是否可以与目录中的属性相关联，新类型的选项如何影响属性值的传输，以及在属性描述层次结构中如何处理新类型的选项。
Options are represented as short, case-insensitive textual strings conforming to the <option> production defined in Section 2.5 of this document.
选项表示为简短、不区分大小写的文本字符串，符合本文件第2.5节中定义的<option>产品。
Procedures for registering options are detailed in BCP 64, RFC 4520 [RFC4520].
注册选项的程序详见BCP 64、RFC 4520[RFC4520]。
Attributes held in the directory can have attribute descriptions with any number of tagging options. Tagging options are never mutually exclusive.
目录中保存的属性可以具有具有任意数量标记选项的属性描述。标记选项从来都不是互斥的。
An attribute description with N tagging options is a direct (description) subtype of all attribute descriptions of the same attribute type and all but one of the N options. If the attribute type has a supertype, then the attribute description is also a direct (description) subtype of the attribute description of the supertype and the N tagging options. That is, 'cn;lang-de;lang-en' is a direct (description) subtype of 'cn;lang-de', 'cn;lang-en', and 'name;lang-de;lang-en' ('cn' is a subtype of 'name'; both are defined in [RFC4519]).
具有N个标记选项的属性描述是同一属性类型的所有属性描述以及N个选项中除一个之外的所有属性描述的直接（描述）子类型。如果属性类型具有超类型，则属性描述也是该超类型的属性描述和N标记选项的直接（描述）子类型。即"cn",；朗德；“郎恩”是“cn”的直接（描述）子类型；朗德中国；“郎恩”和“名字”；朗德；lang en'（'cn'是'name'的子类型；两者都在[RFC4519]中定义）。
An attribute description can be the direct subtype of zero or more other attribute descriptions as indicated by attribute type subtyping (as described in Section 2.5.1) or attribute tagging option subtyping (as described in Section 2.5.2.1). These subtyping relationships are used to form hierarchies of attribute descriptions and attributes.
属性描述可以是零个或多个其他属性描述的直接子类型，如属性类型子类型（如第2.5.1节所述）或属性标记选项子类型（如第2.5.2.1节所述）所示。这些子类型关系用于形成属性描述和属性的层次结构。
As adapted from [X.501]:
根据[X.501]改编：
Attribute hierarchies allow access to the DIB with varying degrees of granularity. This is achieved by allowing the value components of attributes to be accessed by using either their specific attribute description (a direct reference to the attribute) or a more generic attribute description (an indirect reference).
属性层次结构允许以不同的粒度访问DIB。这是通过允许使用属性的特定属性描述（对属性的直接引用）或更通用的属性描述（间接引用）来访问属性的值组件来实现的。
Semantically related attributes may be placed in a hierarchical relationship, the more specialized being placed subordinate to the more generalized. Searching for or retrieving attributes and their values is made easier by quoting the more generalized attribute description; a filter item so specified is evaluated for the more specialized descriptions as well as for the quoted description.
语义相关的属性可以放在层次关系中，更专业的属性可以从属于更一般的属性。通过引用更一般化的属性描述，可以更轻松地搜索或检索属性及其值；这样指定的过滤器项将针对更专门的描述以及引用的描述进行评估。
Where subordinate specialized descriptions are selected to be returned as part of a search result these descriptions shall be returned if available. Where the more general descriptions are selected to be returned as part of a search result both the general and the specialized descriptions shall be returned, if available. An attribute value shall always be returned as a value of its own attribute description.
如果选择作为搜索结果的一部分返回从属专门描述，则应返回这些描述（如果可用）。如果选择更一般的描述作为搜索结果的一部分返回，则应返回一般描述和专门描述（如果可用）。属性值应始终作为其自身属性描述的值返回。
All of the attribute descriptions in an attribute hierarchy are treated as distinct and unrelated descriptions for user modification of entry content.
属性层次结构中的所有属性描述都被视为不同且不相关的描述，用于用户修改条目内容。
An attribute value stored in an object or alias entry is of precisely one attribute description. The description is indicated when the value is originally added to the entry.
存储在对象或别名条目中的属性值正好是一个属性描述。最初将值添加到条目时，将指示说明。
For the purpose of subschema administration of the entry, a specification that an attribute is required is fulfilled if the entry contains a value of an attribute description belonging to an attribute hierarchy where the attribute type of that description is the same as the required attribute's type. That is, a "MUST name" specification is fulfilled by 'name' or 'name;x-tag-option', but is not fulfilled by 'CN' or 'CN;x-tag-option' (even though 'CN' is a subtype of 'name'). Likewise, an entry may contain a value of an attribute description belonging to an attribute hierarchy where the attribute type of that description is either explicitly included in the definition of an object class to which the entry belongs or allowed by the DIT content rule applicable to that entry. That is, 'name' and 'name;x-tag-option' are allowed by "MAY name" (or by "MUST name"), but 'CN' and 'CN;x-tag-option' are not allowed by "MAY name" (or by "MUST name").
为了对条目进行子模式管理，如果条目包含属于属性层次结构的属性描述值，且该描述的属性类型与所需属性的类型相同，则满足要求属性的规范。也就是说，“必须命名”规范由“名称”或“名称”实现；x-tag-option'，但未由'CN'或'CN'实现；x-tag-option'（即使'CN'是'name'的子类型）。同样，条目可能包含属于属性层次结构的属性描述值，其中该描述的属性类型明确包含在条目所属对象类的定义中，或适用于该条目的DIT内容规则允许。即"名"和"名",；x-tag-option’允许使用“可能名称”（或“必须名称”），但不允许使用“CN”和“CN”；“可能名称”（或“必须名称”）不允许使用x-tag-option。
For the purposes of other policy administration, unless stated otherwise in the specification of the particular administrative model, all of the attribute descriptions in an attribute hierarchy are treated as distinct and unrelated descriptions.
对于其他策略管理，除非在特定管理模型的规范中另有说明，否则属性层次结构中的所有属性描述都被视为不同且不相关的描述。
As adapted from [X.501]:
根据[X.501]改编：
An alias, or an alias name, for an object is an alternative name for an object or object entry which is provided by the use of alias entries.
对象的别名或别名是通过使用别名条目提供的对象或对象条目的替代名称。
Each alias entry contains, within the 'aliasedObjectName' attribute (known as the 'aliasedEntryName' attribute in X.500), a name of some object. The distinguished name of the alias entry is thus also a name for this object.
每个别名条目在“aliasedObjectName”属性（在X.500中称为“aliasedEntryName”属性）中包含某个对象的名称。因此，别名条目的可分辨名称也是此对象的名称。
NOTE - The name within the 'aliasedObjectName' is said to be pointed to by the alias. It does not have to be the distinguished name of any entry.
注意-“aliasedObjectName”中的名称被称为由别名指向。它不必是任何条目的可分辨名称。
The conversion of an alias name to an object name is termed (alias) dereferencing and comprises the systematic replacement of alias names, where found within a purported name, by the value of the corresponding 'aliasedObjectName' attribute. The process may require the examination of more than one alias entry.
别名到对象名的转换称为（别名）解引用，包括用相应的“aliasedObjectName”属性的值系统地替换别名（在声称的名称中）。该过程可能需要检查多个别名条目。
Any particular entry in the DIT may have zero or more alias names. It therefore follows that several alias entries may point to the same entry. An alias entry may point to an entry that is not a leaf entry and may point to another alias entry.
DIT中的任何特定条目都可能有零个或多个别名。因此，几个别名条目可能指向同一条目。别名条目可以指向不是叶条目的条目，也可以指向另一个别名条目。
An alias entry shall have no subordinates, so that an alias entry is always a leaf entry.
别名条目不应有从属项，因此别名条目始终是叶条目。
Every alias entry shall belong to the 'alias' object class.
每个别名条目都应属于“别名”对象类。
An entry with the 'alias' object class must also belong to an object class (or classes), or be governed by a DIT content rule, which allows suitable naming attributes to be present.
具有“alias”对象类的条目还必须属于一个或多个对象类，或由DIT内容规则管理，该规则允许存在适当的命名属性。
Example:
例子：
dn: cn=bar,dc=example,dc=com
objectClass: top
objectClass: alias
objectClass: extensibleObject
dn: cn=bar,dc=example,dc=com
objectClass: top
objectClass: alias
objectClass: extensibleObject
cn: bar
aliasedObjectName: cn=foo,dc=example,dc=com
cn: bar
aliasedObjectName: cn=foo,dc=example,dc=com
Alias entries belong to the 'alias' object class.
别名条目属于“Alias”对象类。
( 2.5.6.1 NAME 'alias' SUP top STRUCTURAL MUST aliasedObjectName )
（2.5.6.1名称“alias”SUP top STRUCTURAL必须别名为Object NAME）
The 'aliasedObjectName' attribute holds the name of the entry an alias points to. The 'aliasedObjectName' attribute is known as the 'aliasedEntryName' attribute in X.500.
“aliasedObjectName”属性保存别名指向的条目的名称。“aliasedObjectName”属性在X.500中称为“aliasedEntryName”属性。
( 2.5.4.1 NAME 'aliasedObjectName' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
（2.5.4.1名称“别名对象名称”相等区分名称匹配语法1.3.6.1.4.1.1466.115.121.1.12单值）
The 'distinguishedNameMatch' matching rule and the DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax are defined in [RFC4517].
[RFC4517]中定义了“DifferentizedNameMatch”匹配规则和DifferentizedName（1.3.6.1.4.1.1466.115.121.1.12）语法。
This section discusses select aspects of the X.500 Directory Administrative and Operational Information model [X.501]. LDAP implementations MAY support other aspects of this model.
本节讨论X.500目录管理和操作信息模型[X.501]的某些方面。LDAP实现可能支持此模型的其他方面。
As defined in [X.501]:
如[X.501]中所定义：
A subtree is a collection of object and alias entries situated at the vertices of a tree. Subtrees do not contain subentries. The prefix sub, in subtree, emphasizes that the base (or root) vertex of this tree is usually subordinate to the root of the DIT.
子树是位于树顶点的对象和别名项的集合。子树不包含子项。子树中的前缀sub强调此树的基（或根）顶点通常从属于DIT的根。
A subtree begins at some vertex and extends to some identifiable lower boundary, possibly extending to leaves. A subtree is always defined within a context which implicitly bounds the subtree. For example, the vertex and lower boundaries of a subtree defining a replicated area are bounded by a naming context.
子树从某个顶点开始，延伸到某个可识别的下边界，可能延伸到叶子。子树总是在隐式限定子树的上下文中定义的。例如，定义复制区域的子树的顶点和下边界由命名上下文限定。
A subentry is a "special sort of entry, known by the Directory, used to hold information associated with a subtree or subtree refinement" [X.501]. Subentries are used in Directory to hold for administrative and operational purposes as defined in [X.501]. Their use in LDAP is detailed in [RFC3672].
子条目是“目录所知的特殊类型的条目，用于保存与子树或子树细化相关的信息”[X.501]。子条目在目录中用于保存[X.501]中定义的管理和操作目的。[RFC3672]中详细介绍了它们在LDAP中的使用。
The term "(sub)entry" in this specification indicates that servers implementing X.500(93) models are, in accordance with X.500(93) as described in [RFC3672], to use a subentry and that other servers are to use an object entry belonging to the appropriate auxiliary class normally used with the subentry (e.g., 'subschema' for subschema subentries) to mimic the subentry. This object entry's RDN SHALL be formed from a value of the 'cn' (commonName) attribute [RFC4519] (as all subentries are named with 'cn').
本规范中的术语“（子）项”表示，根据[RFC3672]中所述的X.500（93）模型，实现X.500（93）模型的服务器将使用子项，其他服务器将使用属于通常与子项一起使用的适当辅助类的对象项（例如，子模式子项的“子模式”）模仿子条目。此对象条目的RDN应由'cn'（commonName）属性[RFC4519]的值构成（因为所有子条目都用'cn'命名）。
Each entry in the DIT has an 'objectClass' attribute.
DIT中的每个条目都有一个“objectClass”属性。
( 2.5.4.0 NAME 'objectClass' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
（2.5.4.0名称'objectClass'相等objectIdentifierMatch语法1.3.6.1.4.1.1466.115.121.1.38）
The 'objectIdentifierMatch' matching rule and the OBJECT IDENTIFIER (1.3.6.1.4.1.1466.115.121.1.38) syntax are defined in [RFC4517].
[RFC4517]中定义了“objectIdentifierMatch”匹配规则和对象标识符（1.3.6.1.4.1.1466.115.121.1.38）语法。
The 'objectClass' attribute specifies the object classes of an entry, which (among other things) are used in conjunction with the controlling schema to determine the permitted attributes of an entry. Values of this attribute can be modified by clients, but the 'objectClass' attribute cannot be removed.
“objectClass”属性指定条目的对象类，这些对象类（除其他外）与控制模式结合使用，以确定条目的允许属性。客户端可以修改此属性的值，但不能删除“objectClass”属性。
Servers that follow X.500(93) models SHALL restrict modifications of this attribute to prevent the basic structural class of the entry from being changed. That is, one cannot change a 'person' into a 'country'.
遵循X.500（93）模型的服务器应限制此属性的修改，以防止条目的基本结构类发生更改。也就是说，一个人不能把一个人变成一个国家。
When creating an entry or adding an 'objectClass' value to an entry, all superclasses of the named classes SHALL be implicitly added as well if not already present. That is, if the auxiliary class 'x-a' is a subclass of the class 'x-b', adding 'x-a' to 'objectClass' causes 'x-b' to be implicitly added (if is not already present).
创建条目或向条目添加“objectClass”值时，命名类的所有超类（如果尚未存在）也应隐式添加。也就是说，如果辅助类“x-a”是类“x-b”的子类，则将“x-a”添加到“objectClass”会导致隐式添加“x-b”（如果尚未存在）。
Servers SHALL restrict modifications of this attribute to prevent superclasses of remaining 'objectClass' values from being deleted. That is, if the auxiliary class 'x-a' is a subclass of the auxiliary
服务器应限制对此属性的修改，以防止删除剩余“objectClass”值的超类。也就是说，如果辅助类“x-a”是辅助类的子类
class 'x-b' and the 'objectClass' attribute contains 'x-a' and 'x-b', an attempt to delete only 'x-b' from the 'objectClass' attribute is an error.
类“x-b”和“objectClass”属性包含“x-a”和“x-b”，尝试仅从“objectClass”属性中删除“x-b”是错误的。
Some attributes, termed operational attributes, are used or maintained by servers for administrative and operational purposes. As stated in [X.501]: "There are three varieties of operational attributes: Directory operational attributes, DSA-shared operational attributes, and DSA-specific operational attributes".
服务器出于管理和操作目的使用或维护某些属性（称为操作属性）。如[X.501]所述：“有三种操作属性：目录操作属性、DSA共享操作属性和DSA特定操作属性”。
A directory operational attribute is used to represent operational and/or administrative information in the Directory Information Model. This includes operational attributes maintained by the server (e.g., 'createTimestamp') as well as operational attributes that hold values administrated by the user (e.g., 'ditContentRules').
目录操作属性用于表示目录信息模型中的操作和/或管理信息。这包括由服务器维护的操作属性（如“createTimestamp”）以及保存由用户管理的值的操作属性（如“ditContentRules”）。
A DSA-shared operational attribute is used to represent information of the DSA Information Model that is shared between DSAs.
DSA共享操作属性用于表示DSA之间共享的DSA信息模型的信息。
A DSA-specific operational attribute is used to represent information of the DSA Information Model that is specific to the DSA (though, in some cases, may be derived from information shared between DSAs; e.g., 'namingContexts').
特定于DSA的操作属性用于表示特定于DSA的DSA信息模型的信息（不过，在某些情况下，可以从DSA之间共享的信息中派生；例如，“NamingContext”）。
The DSA Information Model operational attributes are detailed in [X.501].
DSA信息模型操作属性在[X.501]中有详细说明。
Operational attributes are not normally visible. They are not returned in search results unless explicitly requested by name.
操作属性通常不可见。除非通过名称明确请求，否则它们不会在搜索结果中返回。
Not all operational attributes are user modifiable.
并非所有操作属性都是用户可修改的。
Entries may contain, among others, the following operational attributes:
除其他外，条目可能包含以下操作属性：
- creatorsName: the Distinguished Name of the user who added this entry to the directory,
- creatorsName：将此条目添加到目录的用户的可分辨名称，
- createTimestamp: the time this entry was added to the directory,
- createTimestamp：此条目添加到目录的时间，
- modifiersName: the Distinguished Name of the user who last modified this entry, and
- ModifierName：上次修改此条目的用户的可分辨名称，以及
- modifyTimestamp: the time this entry was last modified.
- modifyTimestamp：上次修改此条目的时间。
Servers SHOULD maintain the 'creatorsName', 'createTimestamp', 'modifiersName', and 'modifyTimestamp' attributes for all entries of the DIT.
服务器应为DIT的所有条目维护“CreatorName”、“CreateTimstamp”、“ModifierName”和“modifyTimestamp”属性。
This attribute appears in entries that were added using the protocol (e.g., using the Add operation). The value is the distinguished name of the creator.
此属性出现在使用协议添加的条目中（例如，使用添加操作）。该值是创建者的可分辨名称。
( 2.5.18.3 NAME 'creatorsName' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
（2.5.18.3名称“创建者名称”相等区分名称匹配语法1.3.6.1.4.1.1466.115.121.1.12单值无用户修改使用目录操作）
The 'distinguishedNameMatch' matching rule and the DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax are defined in [RFC4517].
[RFC4517]中定义了“DifferentizedNameMatch”匹配规则和DifferentizedName（1.3.6.1.4.1.1466.115.121.1.12）语法。
This attribute appears in entries that were added using the protocol (e.g., using the Add operation). The value is the time the entry was added.
此属性出现在使用协议添加的条目中（例如，使用添加操作）。该值是添加条目的时间。
( 2.5.18.1 NAME 'createTimestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
（2.5.18.1名称'createTimestamp'相等GeneraledTimeMatch排序GeneraledTimeOrderingMatch语法1.3.6.1.4.1.1466.115.121.1.24单值无用户修改使用目录操作）
The 'generalizedTimeMatch' and 'generalizedTimeOrderingMatch' matching rules and the GeneralizedTime (1.3.6.1.4.1.1466.115.121.1.24) syntax are defined in [RFC4517].
[RFC4517]中定义了“GeneratedTimeMatch”和“GeneratedTimeOrderingMatch”匹配规则以及GeneratedTime（1.3.6.1.4.1.1466.115.121.1.24）语法。
This attribute appears in entries that have been modified using the protocol (e.g., using the Modify operation). The value is the distinguished name of the last modifier.
此属性出现在使用协议修改的条目中（例如，使用修改操作）。该值是最后一个修饰符的可分辨名称。
( 2.5.18.4 NAME 'modifiersName' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
（2.5.18.4名称'ModifierName'相等区分名称匹配语法1.3.6.1.4.1.1466.115.121.1.12单值无用户修改使用目录操作）
The 'distinguishedNameMatch' matching rule and the DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax are defined in [RFC4517].
[RFC4517]中定义了“DifferentizedNameMatch”匹配规则和DifferentizedName（1.3.6.1.4.1.1466.115.121.1.12）语法。
This attribute appears in entries that have been modified using the protocol (e.g., using the Modify operation). The value is the time the entry was last modified.
此属性出现在使用协议修改的条目中（例如，使用修改操作）。该值是上次修改条目的时间。
( 2.5.18.2 NAME 'modifyTimestamp' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
（2.5.18.2名称'modifyTimestamp'相等GeneraledTimeMatch排序GeneraledTimeOrderingMatch语法1.3.6.1.4.1.1466.115.121.1.24单值无用户修改使用目录操作）
The 'generalizedTimeMatch' and 'generalizedTimeOrderingMatch' matching rules and the GeneralizedTime (1.3.6.1.4.1.1466.115.121.1.24) syntax are defined in [RFC4517].
[RFC4517]中定义了“GeneratedTimeMatch”和“GeneratedTimeOrderingMatch”匹配规则以及GeneratedTime（1.3.6.1.4.1.1466.115.121.1.24）语法。
This attribute indicates the structural object class of the entry.
此属性表示条目的结构对象类。
( 2.5.21.9 NAME 'structuralObjectClass' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
（2.5.21.9名称“StructureObjectClass”相等objectIdentifierMatch语法1.3.6.1.4.1.1466.115.121.1.38单值无用户修改使用目录操作）
The 'objectIdentifierMatch' matching rule and OBJECT IDENTIFIER (1.3.6.1.4.1.1466.115.121.1.38) syntax is defined in [RFC4517].
[RFC4517]中定义了“objectIdentifierMatch”匹配规则和对象标识符（1.3.6.1.4.1.1466.115.121.1.38）语法。
This attribute indicates the structure rule governing the entry.
此属性表示管理条目的结构规则。
( 2.5.21.10 NAME 'governingStructureRule' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
（2.5.21.10名称“governingStructureRule”相等整数匹配语法1.3.6.1.4.1.1466.115.121.1.27单值无用户修改使用目录操作）
The 'integerMatch' matching rule and INTEGER (1.3.6.1.4.1.1466.115.121.1.27) syntax is defined in [RFC4517].
[RFC4517]中定义了“integerMatch”匹配规则和整数（1.3.6.1.4.1.1466.115.121.1.27）语法。
As defined in [X.501]:
如[X.501]中所定义：
The Directory Schema is a set of definitions and constraints concerning the structure of the DIT, the possible ways entries are named, the information that can be held in an entry, the attributes used to represent that information and their organization into hierarchies to facilitate search and retrieval of the information and the ways in which values of attributes may be matched in attribute value and matching rule assertions.
目录模式是一组定义和约束，涉及DIT的结构、条目的可能命名方式、条目中可以保存的信息、，用于将信息及其组织表示为层次结构的属性，以便于搜索和检索信息，以及在属性值和匹配规则断言中匹配属性值的方式。
NOTE 1 - The schema enables the Directory system to, for example:
注1-模式使目录系统能够，例如：
- prevent the creation of subordinate entries of the wrong object-class (e.g., a country as a subordinate of a person);
- 防止创建错误对象类别的从属条目（例如，作为个人从属的国家）；
- prevent the addition of attribute-types to an entry inappropriate to the object-class (e.g., a serial number to a person's entry);
- 防止向不适合对象类的条目添加属性类型（例如，个人条目的序列号）；
- prevent the addition of an attribute value of a syntax not matching that defined for the attribute-type (e.g., a printable string to a bit string).
- 防止添加与为属性类型定义的语法不匹配的属性值（例如，可打印字符串到位字符串）。
Formally, the Directory Schema comprises a set of:
在形式上，目录模式包括一组：
a) Name Form definitions that define primitive naming relations for structural object classes;
a) 定义结构对象类的基本命名关系的命名形式定义；
b) DIT Structure Rule definitions that define the names that entries may have and the ways in which the entries may be related to one another in the DIT;
b) DIT结构规则定义，定义条目可能具有的名称以及条目在DIT中相互关联的方式；
c) DIT Content Rule definitions that extend the specification of allowable attributes for entries beyond those indicated by the structural object classes of the entries;
c) DIT内容规则定义，扩展了条目的允许属性规范，超出了条目的结构对象类所指示的属性规范；
d) Object Class definitions that define the basic set of mandatory and optional attributes that shall be present, and may be present, respectively, in an entry of a given class, and which indicate the kind of object class that is being defined;
d) 对象类定义，定义在给定类的条目中应存在和可能存在的强制性和可选属性的基本集合，并指示要定义的对象类的类型；
e) Attribute Type definitions that identify the object identifier by which an attribute is known, its syntax, associated matching rules, whether it is an operational attribute and if so its type, whether it is a collective attribute, whether it is permitted to have multiple values and whether or not it is derived from another attribute type;
e) 属性类型定义，用于标识已知属性的对象标识符、其语法、关联的匹配规则、是否为操作属性（如果为操作属性，则为其类型）、是否为集合属性、是否允许具有多个值以及是否派生自另一个属性类型；
f) Matching Rule definitions that define matching rules.
f) 定义匹配规则的匹配规则定义。
And in LDAP:
在LDAP中：
g) LDAP Syntax definitions that define encodings used in LDAP.
g) 定义LDAP中使用的编码的LDAP语法定义。
Schema definitions in this section are described using ABNF and rely on the common productions specified in Section 1.2 as well as these:
本节中的模式定义使用ABNF进行描述，并依赖于第1.2节中规定的常见产品以及以下内容：
noidlen = numericoid [ LCURLY len RCURLY ] len = number
noidlen=numericoid[LCURLY len RCURLY]len=number
oids = oid / ( LPAREN WSP oidlist WSP RPAREN )
oidlist = oid *( WSP DOLLAR WSP oid )
oids = oid / ( LPAREN WSP oidlist WSP RPAREN )
oidlist = oid *( WSP DOLLAR WSP oid )
extensions = *( SP xstring SP qdstrings )
xstring = "X" HYPHEN 1*( ALPHA / HYPHEN / USCORE )
extensions = *( SP xstring SP qdstrings )
xstring = "X" HYPHEN 1*( ALPHA / HYPHEN / USCORE )
qdescrs = qdescr / ( LPAREN WSP qdescrlist WSP RPAREN )
qdescrlist = [ qdescr *( SP qdescr ) ]
qdescr = SQUOTE descr SQUOTE
qdescrs = qdescr / ( LPAREN WSP qdescrlist WSP RPAREN )
qdescrlist = [ qdescr *( SP qdescr ) ]
qdescr = SQUOTE descr SQUOTE
qdstrings = qdstring / ( LPAREN WSP qdstringlist WSP RPAREN )
qdstringlist = [ qdstring *( SP qdstring ) ]
qdstring = SQUOTE dstring SQUOTE
dstring = 1*( QS / QQ / QUTF8 ) ; escaped UTF-8 string
qdstrings = qdstring / ( LPAREN WSP qdstringlist WSP RPAREN )
qdstringlist = [ qdstring *( SP qdstring ) ]
qdstring = SQUOTE dstring SQUOTE
dstring = 1*( QS / QQ / QUTF8 ) ; escaped UTF-8 string
QQ = ESC %x32 %x37 ; "\27"
QS = ESC %x35 ( %x43 / %x63 ) ; "\5C" / "\5c"
QQ = ESC %x32 %x37 ; "\27"
QS = ESC %x35 ( %x43 / %x63 ) ; "\5C" / "\5c"
; Any UTF-8 encoded Unicode character ; except %x27 ("\'") and %x5C ("\") QUTF8 = QUTF1 / UTFMB
; 任何UTF-8编码的Unicode字符；除了%x27（“\”）和%x5C（“\”）QUTF8=QUTF1/UTFMB
; Any ASCII character except %x27 ("\'") and %x5C ("\")
QUTF1 = %x00-26 / %x28-5B / %x5D-7F
; Any ASCII character except %x27 ("\'") and %x5C ("\")
QUTF1 = %x00-26 / %x28-5B / %x5D-7F
Schema definitions in this section also share a number of common terms.
本节中的模式定义还共享许多常用术语。
The NAME field provides a set of short names (descriptors) that are to be used as aliases for the OID.
“名称”字段提供一组短名称（描述符），用作OID的别名。
The DESC field optionally allows a descriptive string to be provided by the directory administrator and/or implementor. While specifications may suggest a descriptive string, there is no requirement that the suggested (or any) descriptive string be used.
DESC字段允许目录管理员和/或实现者提供描述性字符串。虽然规范可能建议使用描述性字符串，但不要求使用建议的（或任何）描述性字符串。
The OBSOLETE field, if present, indicates the element is not active.
过时字段（如果存在）表示元素未激活。
Implementors should note that future versions of this document may expand these definitions to include additional terms. Terms whose identifier begins with "X-" are reserved for private experiments and are followed by <SP> and <qdstrings> tokens.
实施者应注意，本文档的未来版本可能会扩展这些定义，以包括其他术语。标识符以“X-”开头的术语保留用于私人实验，后面紧跟<SP>和<qdstrings>标记。
Object Class definitions are written according to the ABNF:
对象类定义是根据ABNF编写的：
ObjectClassDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
[ SP "SUP" SP oids ] ; superior object classes
[ SP kind ] ; kind of class
[ SP "MUST" SP oids ] ; attribute types
[ SP "MAY" SP oids ] ; attribute types
extensions WSP RPAREN
ObjectClassDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
[ SP "SUP" SP oids ] ; superior object classes
[ SP kind ] ; kind of class
[ SP "MUST" SP oids ] ; attribute types
[ SP "MAY" SP oids ] ; attribute types
extensions WSP RPAREN
kind = "ABSTRACT" / "STRUCTURAL" / "AUXILIARY"
kind = "ABSTRACT" / "STRUCTURAL" / "AUXILIARY"
where:
<numericoid> is object identifier assigned to this object class;
NAME <qdescrs> are short names (descriptors) identifying this
object class;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this object class is not active;
SUP <oids> specifies the direct superclasses of this object class;
the kind of object class is indicated by one of ABSTRACT,
STRUCTURAL, or AUXILIARY (the default is STRUCTURAL);
MUST and MAY specify the sets of required and allowed attribute
types, respectively; and
<extensions> describe extensions.
where:
<numericoid> is object identifier assigned to this object class;
NAME <qdescrs> are short names (descriptors) identifying this
object class;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this object class is not active;
SUP <oids> specifies the direct superclasses of this object class;
the kind of object class is indicated by one of ABSTRACT,
STRUCTURAL, or AUXILIARY (the default is STRUCTURAL);
MUST and MAY specify the sets of required and allowed attribute
types, respectively; and
<extensions> describe extensions.
Attribute Type definitions are written according to the ABNF:
属性类型定义是根据ABNF编写的：
AttributeTypeDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
[ SP "SUP" SP oid ] ; supertype
[ SP "EQUALITY" SP oid ] ; equality matching rule
[ SP "ORDERING" SP oid ] ; ordering matching rule
[ SP "SUBSTR" SP oid ] ; substrings matching rule
[ SP "SYNTAX" SP noidlen ] ; value syntax
[ SP "SINGLE-VALUE" ] ; single-value
[ SP "COLLECTIVE" ] ; collective
[ SP "NO-USER-MODIFICATION" ] ; not user modifiable
[ SP "USAGE" SP usage ] ; usage
extensions WSP RPAREN ; extensions
AttributeTypeDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
[ SP "SUP" SP oid ] ; supertype
[ SP "EQUALITY" SP oid ] ; equality matching rule
[ SP "ORDERING" SP oid ] ; ordering matching rule
[ SP "SUBSTR" SP oid ] ; substrings matching rule
[ SP "SYNTAX" SP noidlen ] ; value syntax
[ SP "SINGLE-VALUE" ] ; single-value
[ SP "COLLECTIVE" ] ; collective
[ SP "NO-USER-MODIFICATION" ] ; not user modifiable
[ SP "USAGE" SP usage ] ; usage
extensions WSP RPAREN ; extensions
usage = "userApplications" / ; user
"directoryOperation" / ; directory operational
"distributedOperation" / ; DSA-shared operational
"dSAOperation" ; DSA-specific operational
usage = "userApplications" / ; user
"directoryOperation" / ; directory operational
"distributedOperation" / ; DSA-shared operational
"dSAOperation" ; DSA-specific operational
where:
<numericoid> is object identifier assigned to this attribute type;
NAME <qdescrs> are short names (descriptors) identifying this
attribute type;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this attribute type is not active;
SUP oid specifies the direct supertype of this type;
EQUALITY, ORDERING, and SUBSTR provide the oid of the equality,
ordering, and substrings matching rules, respectively;
SYNTAX identifies value syntax by object identifier and may suggest
a minimum upper bound;
SINGLE-VALUE indicates attributes of this type are restricted to a
single value;
COLLECTIVE indicates this attribute type is collective
[X.501][RFC3671];
NO-USER-MODIFICATION indicates this attribute type is not user
modifiable;
USAGE indicates the application of this attribute type; and
<extensions> describe extensions.
where:
<numericoid> is object identifier assigned to this attribute type;
NAME <qdescrs> are short names (descriptors) identifying this
attribute type;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this attribute type is not active;
SUP oid specifies the direct supertype of this type;
EQUALITY, ORDERING, and SUBSTR provide the oid of the equality,
ordering, and substrings matching rules, respectively;
SYNTAX identifies value syntax by object identifier and may suggest
a minimum upper bound;
SINGLE-VALUE indicates attributes of this type are restricted to a
single value;
COLLECTIVE indicates this attribute type is collective
[X.501][RFC3671];
NO-USER-MODIFICATION indicates this attribute type is not user
modifiable;
USAGE indicates the application of this attribute type; and
<extensions> describe extensions.
Each attribute type description must contain at least one of the SUP or SYNTAX fields. If no SYNTAX field is provided, the attribute type description takes its value from the supertype.
每个属性类型描述必须至少包含一个SUP或语法字段。如果未提供语法字段，则属性类型描述从超类型获取其值。
If SUP field is provided, the EQUALITY, ORDERING, and SUBSTRING fields, if not specified, take their value from the supertype.
如果提供了SUP字段，则相等字段、排序字段和子字符串字段（如果未指定）从超类型中获取其值。
Usage of userApplications, the default, indicates that attributes of this type represent user information. That is, they are user attributes.
默认情况下，userApplications的用法表示此类型的属性表示用户信息。也就是说，它们是用户属性。
A usage of directoryOperation, distributedOperation, or dSAOperation indicates that attributes of this type represent operational and/or administrative information. That is, they are operational attributes.
使用directoryOperation、distributedOperation或dSAOperation表示此类型的属性表示操作和/或管理信息。也就是说，它们是操作属性。
directoryOperation usage indicates that the attribute of this type is a directory operational attribute. distributedOperation usage indicates that the attribute of this type is a DSA-shared usage operational attribute. dSAOperation usage indicates that the attribute of this type is a DSA-specific operational attribute.
directoryOperation用法表示此类型的属性是目录操作属性。distributedOperation usage表示此类型的属性是DSA共享使用操作属性。dSAOperation usage表示此类型的属性是DSA特定的操作属性。
COLLECTIVE requires usage userApplications. Use of collective attribute types in LDAP is discussed in [RFC3671].
集体需要使用用户应用程序。[RFC3671]中讨论了在LDAP中使用集合属性类型。
NO-USER-MODIFICATION requires an operational usage.
无用户修改需要操作使用。
Note that the <AttributeTypeDescription> does not list the matching rules that can be used with that attribute type in an extensibleMatch search filter [RFC4511]. This is done using the 'matchingRuleUse' attribute described in Section 4.1.4.
请注意，<AttributeTypeDescription>没有列出可在ExtensionMatch搜索筛选器[RFC4511]中与该属性类型一起使用的匹配规则。这是使用第4.1.4节中描述的“matchingRuleUse”属性完成的。
This document refines the schema description of X.501 by requiring that the SYNTAX field in an <AttributeTypeDescription> be a string representation of an object identifier for the LDAP string syntax definition, with an optional indication of the suggested minimum bound of a value of this attribute.
本文档通过要求<AttributeTypeDescription>中的语法字段是LDAP字符串语法定义的对象标识符的字符串表示形式，以及该属性值的建议最小界限的可选指示，细化了X.501的模式描述。
A suggested minimum upper bound on the number of characters in a value with a string-based syntax, or the number of bytes in a value for all other syntaxes, may be indicated by appending this bound count inside of curly braces following the syntax's OBJECT IDENTIFIER in an Attribute Type Description. This bound is not part of the syntax name itself. For instance, "1.3.6.4.1.1466.0{64}" suggests that server implementations should allow a string to be 64 characters long, although they may allow longer strings. Note that a single character of the Directory String syntax may be encoded in more than one octet since UTF-8 [RFC3629] is a variable-length encoding.
使用基于字符串的语法的值中的字符数或所有其他语法的值中的字节数的建议最小上限，可以通过在属性类型描述中语法的对象标识符之后的大括号内追加此绑定计数来指示。此绑定不是语法名称本身的一部分。例如，“1.3.6.4.1.1466.0{64}”建议服务器实现应允许字符串长度为64个字符，尽管它们可能允许更长的字符串。注意，由于UTF-8[RFC3629]是一种可变长度编码，目录字符串语法的单个字符可以编码为多个八位字节。
Matching rules are used in performance of attribute value assertions, such as in performance of a Compare operation. They are also used in evaluating search filters, determining which individual values are to be added or deleted during performance of a Modify operation, and in comparing distinguished names.
匹配规则用于属性值断言的执行，例如比较操作的执行。它们还用于评估搜索筛选器，确定在执行修改操作期间要添加或删除的单个值，以及比较可分辨名称。
Each matching rule is identified by an object identifier (OID) and, optionally, one or more short names (descriptors).
每个匹配规则由对象标识符（OID）和一个或多个短名称（描述符）标识。
Matching rule definitions are written according to the ABNF:
根据ABNF编写匹配规则定义：
MatchingRuleDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
SP "SYNTAX" SP numericoid ; assertion syntax
extensions WSP RPAREN ; extensions
MatchingRuleDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
SP "SYNTAX" SP numericoid ; assertion syntax
extensions WSP RPAREN ; extensions
where:
<numericoid> is object identifier assigned to this matching rule;
NAME <qdescrs> are short names (descriptors) identifying this
matching rule;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this matching rule is not active;
SYNTAX identifies the assertion syntax (the syntax of the assertion
value) by object identifier; and
<extensions> describe extensions.
where:
<numericoid> is object identifier assigned to this matching rule;
NAME <qdescrs> are short names (descriptors) identifying this
matching rule;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this matching rule is not active;
SYNTAX identifies the assertion syntax (the syntax of the assertion
value) by object identifier; and
<extensions> describe extensions.
A matching rule use lists the attribute types that are suitable for use with an extensibleMatch search filter.
匹配规则使用列出了适合与ExtensionMatch搜索筛选器一起使用的属性类型。
Matching rule use descriptions are written according to the following ABNF:
根据以下ABNF编写匹配规则使用说明：
MatchingRuleUseDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
SP "APPLIES" SP oids ; attribute types
extensions WSP RPAREN ; extensions
MatchingRuleUseDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
SP "APPLIES" SP oids ; attribute types
extensions WSP RPAREN ; extensions
where:
<numericoid> is the object identifier of the matching rule
associated with this matching rule use description;
NAME <qdescrs> are short names (descriptors) identifying this
matching rule use;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this matching rule use is not active;
APPLIES provides a list of attribute types the matching rule
applies to; and
<extensions> describe extensions.
where:
<numericoid> is the object identifier of the matching rule
associated with this matching rule use description;
NAME <qdescrs> are short names (descriptors) identifying this
matching rule use;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this matching rule use is not active;
APPLIES provides a list of attribute types the matching rule
applies to; and
<extensions> describe extensions.
LDAP Syntaxes of (attribute and assertion) values are described in terms of ASN.1 [X.680] and, optionally, have an octet string encoding known as the LDAP-specific encoding. Commonly, the LDAP-specific encoding is constrained to a string of Unicode [Unicode] characters in UTF-8 [RFC3629] form.
（属性和断言）值的LDAP语法按照ASN.1[X.680]进行描述，并且可选地具有称为LDAP特定编码的八位字符串编码。通常，特定于LDAP的编码被限制为UTF-8[RFC3629]格式的Unicode[Unicode]字符字符串。
Each LDAP syntax is identified by an object identifier (OID).
每个LDAP语法都由对象标识符（OID）标识。
LDAP syntax definitions are written according to the ABNF:
LDAP语法定义是根据ABNF编写的：
SyntaxDescription = LPAREN WSP numericoid ; object identifier [ SP "DESC" SP qdstring ] ; description extensions WSP RPAREN ; extensions
SyntaxDescription=LPAREN WSP numericoid；对象标识符[SP“DESC”SP qdstring]；描述扩展WSP-RPAREN；扩展
where: <numericoid> is the object identifier assigned to this LDAP syntax; DESC <qdstring> is a short descriptive string; and <extensions> describe extensions.
其中：<numericoid>是分配给此LDAP语法的对象标识符；DESC<qdstring>是一个简短的描述性字符串；和<extensions>描述扩展。
A DIT content rule is a "rule governing the content of entries of a particular structural object class" [X.501].
DIT内容规则是“管理特定结构对象类条目内容的规则”[X.501]。
For DIT entries of a particular structural object class, a DIT content rule specifies which auxiliary object classes the entries are allowed to belong to and which additional attributes (by type) are required, allowed, or not allowed to appear in the entries.
对于特定结构对象类的DIT条目，DIT内容规则指定允许条目属于哪些辅助对象类，以及条目中需要、允许或不允许出现哪些附加属性（按类型）。
The list of precluded attributes cannot include any attribute listed as mandatory in the rule, the structural object class, or any of the allowed auxiliary object classes.
排除属性的列表不能包括规则中列出的任何强制属性、结构对象类或任何允许的辅助对象类。
Each content rule is identified by the object identifier, as well as any short names (descriptors), of the structural object class it applies to.
每个内容规则都由对象标识符以及它所应用的结构对象类的任何短名称（描述符）标识。
An entry may only belong to auxiliary object classes listed in the governing content rule.
条目只能属于管理内容规则中列出的辅助对象类。
An entry must contain all attributes required by the object classes the entry belongs to as well as all attributes required by the governing content rule.
条目必须包含该条目所属的对象类所需的所有属性以及管理内容规则所需的所有属性。
An entry may contain any non-precluded attributes allowed by the object classes the entry belongs to as well as all attributes allowed by the governing content rule.
条目可以包含该条目所属的对象类所允许的任何非排除属性以及管理内容规则所允许的所有属性。
An entry cannot include any attribute precluded by the governing content rule.
条目不能包含管辖内容规则排除的任何属性。
An entry is governed by (if present and active in the subschema) the DIT content rule that applies to the structural object class of the entry (see Section 2.4.2). If no active rule is present for the entry's structural object class, the entry's content is governed by the structural object class (and possibly other aspects of user and system schema). DIT content rules for superclasses of the structural object class of an entry are not applicable to that entry.
条目受适用于条目的结构对象类的DIT内容规则（如果在子模式中存在并处于活动状态）管辖（请参见第2.4.2节）。如果条目的结构对象类不存在活动规则，则条目的内容由结构对象类（以及用户和系统架构的其他方面）控制。条目的结构对象类的超类的DIT内容规则不适用于该条目。
DIT content rule descriptions are written according to the ABNF:
DIT内容规则描述根据ABNF编写：
DITContentRuleDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
[ SP "AUX" SP oids ] ; auxiliary object classes
[ SP "MUST" SP oids ] ; attribute types
[ SP "MAY" SP oids ] ; attribute types
[ SP "NOT" SP oids ] ; attribute types
extensions WSP RPAREN ; extensions
DITContentRuleDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
[ SP "AUX" SP oids ] ; auxiliary object classes
[ SP "MUST" SP oids ] ; attribute types
[ SP "MAY" SP oids ] ; attribute types
[ SP "NOT" SP oids ] ; attribute types
extensions WSP RPAREN ; extensions
where:
<numericoid> is the object identifier of the structural object
class associated with this DIT content rule;
NAME <qdescrs> are short names (descriptors) identifying this DIT
content rule;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this DIT content rule use is not active;
AUX specifies a list of auxiliary object classes that entries
subject to this DIT content rule may belong to;
where:
<numericoid> is the object identifier of the structural object
class associated with this DIT content rule;
NAME <qdescrs> are short names (descriptors) identifying this DIT
content rule;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this DIT content rule use is not active;
AUX specifies a list of auxiliary object classes that entries
subject to this DIT content rule may belong to;
MUST, MAY, and NOT specify lists of attribute types that are required, allowed, or precluded, respectively, from appearing in entries subject to this DIT content rule; and <extensions> describe extensions.
必须、可以和不指定分别要求、允许或禁止出现在受本DIT内容规则约束的条目中的属性类型列表；和<extensions>描述扩展。
It is sometimes desirable to regulate where object and alias entries can be placed in the DIT and how they can be named based upon their structural object class.
有时需要规定对象和别名项在DIT中的位置，以及如何根据其结构对象类命名它们。
A DIT structure rule is a "rule governing the structure of the DIT by specifying a permitted superior to subordinate entry relationship. A structure rule relates a name form, and therefore a structural object class, to superior structure rules. This permits entries of the structural object class identified by the name form to exist in the DIT as subordinates to entries governed by the indicated superior structure rules" [X.501].
DIT结构规则是“通过指定允许的上级与下级进入关系来管理DIT结构的规则。结构规则将名称表单以及结构对象类与上级结构规则相关联。这允许由名称表单标识的结构对象类的条目在DIT中存在，作为受指示的上级结构规则“[X.501]管辖的条目的从属条目。
DIT structure rule descriptions are written according to the ABNF:
DIT结构规则描述根据ABNF编写：
DITStructureRuleDescription = LPAREN WSP
ruleid ; rule identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
SP "FORM" SP oid ; NameForm
[ SP "SUP" ruleids ] ; superior rules
extensions WSP RPAREN ; extensions
DITStructureRuleDescription = LPAREN WSP
ruleid ; rule identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
SP "FORM" SP oid ; NameForm
[ SP "SUP" ruleids ] ; superior rules
extensions WSP RPAREN ; extensions
ruleids = ruleid / ( LPAREN WSP ruleidlist WSP RPAREN )
ruleidlist = ruleid *( SP ruleid )
ruleid = number
ruleids = ruleid / ( LPAREN WSP ruleidlist WSP RPAREN )
ruleidlist = ruleid *( SP ruleid )
ruleid = number
where:
<ruleid> is the rule identifier of this DIT structure rule;
NAME <qdescrs> are short names (descriptors) identifying this DIT
structure rule;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this DIT structure rule use is not active;
FORM is specifies the name form associated with this DIT structure
rule;
SUP identifies superior rules (by rule id); and
<extensions> describe extensions.
where:
<ruleid> is the rule identifier of this DIT structure rule;
NAME <qdescrs> are short names (descriptors) identifying this DIT
structure rule;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this DIT structure rule use is not active;
FORM is specifies the name form associated with this DIT structure
rule;
SUP identifies superior rules (by rule id); and
<extensions> describe extensions.
If no superior rules are identified, the DIT structure rule applies to an autonomous administrative point (e.g., the root vertex of the subtree controlled by the subschema) [X.501].
如果未确定上级规则，则DIT结构规则适用于自治管理点（例如，由子模式控制的子树的根顶点）[X.501]。
A name form "specifies a permissible RDN for entries of a particular structural object class. A name form identifies a named object class and one or more attribute types to be used for naming (i.e., for the RDN). Name forms are primitive pieces of specification used in the definition of DIT structure rules" [X.501].
名称表单“为特定结构对象类的条目指定允许的RDN。名称表单标识命名对象类和一个或多个用于命名（即RDN）的属性类型。名称表单是DIT结构规则定义中使用的基本规范”[X.501]。
Each name form indicates the structural object class to be named, a set of required attribute types, and a set of allowed attribute types. A particular attribute type cannot be in both sets.
每个名称表单表示要命名的结构对象类、一组必需的属性类型和一组允许的属性类型。特定属性类型不能同时在两个集中。
Entries governed by the form must be named using a value from each required attribute type and zero or more values from the allowed attribute types.
表单管理的条目必须使用每个必需属性类型中的值和允许的属性类型中的零或多个值进行命名。
Each name form is identified by an object identifier (OID) and, optionally, one or more short names (descriptors).
每个名称形式由对象标识符（OID）和一个或多个短名称（描述符）标识。
Name form descriptions are written according to the ABNF:
根据ABNF编写姓名表说明：
NameFormDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
SP "OC" SP oid ; structural object class
SP "MUST" SP oids ; attribute types
[ SP "MAY" SP oids ] ; attribute types
extensions WSP RPAREN ; extensions
NameFormDescription = LPAREN WSP
numericoid ; object identifier
[ SP "NAME" SP qdescrs ] ; short names (descriptors)
[ SP "DESC" SP qdstring ] ; description
[ SP "OBSOLETE" ] ; not active
SP "OC" SP oid ; structural object class
SP "MUST" SP oids ; attribute types
[ SP "MAY" SP oids ] ; attribute types
extensions WSP RPAREN ; extensions
where:
<numericoid> is object identifier that identifies this name form;
NAME <qdescrs> are short names (descriptors) identifying this name
form;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this name form is not active;
OC identifies the structural object class this rule applies to,
MUST and MAY specify the sets of required and allowed,
respectively, naming attributes for this name form; and
<extensions> describe extensions.
where:
<numericoid> is object identifier that identifies this name form;
NAME <qdescrs> are short names (descriptors) identifying this name
form;
DESC <qdstring> is a short descriptive string;
OBSOLETE indicates this name form is not active;
OC identifies the structural object class this rule applies to,
MUST and MAY specify the sets of required and allowed,
respectively, naming attributes for this name form; and
<extensions> describe extensions.
All attribute types in the required ("MUST") and allowed ("MAY") lists shall be different.
要求（“必须”）和允许（“可能”）列表中的所有属性类型应不同。
Subschema (sub)entries are used for administering information about the directory schema. A single subschema (sub)entry contains all schema definitions (see Section 4.1) used by entries in a particular part of the directory tree.
子模式（sub）条目用于管理有关目录模式的信息。单个子模式（sub）条目包含目录树特定部分中的条目所使用的所有模式定义（参见第4.1节）。
Servers that follow X.500(93) models SHOULD implement subschema using the X.500 subschema mechanisms (as detailed in Section 12 of [X.501]), so these are not ordinary object entries but subentries (see Section 3.2). LDAP clients SHOULD NOT assume that servers implement any of the other aspects of X.500 subschema.
遵循X.500（93）模型的服务器应使用X.500子模式机制实现子模式（详见[X.501]第12节），因此这些不是普通对象条目，而是子条目（见第3.2节）。LDAP客户端不应假定服务器实现X.500子模式的任何其他方面。
Servers MAY allow subschema modification. Procedures for subschema modification are discussed in Section 14.5 of [X.501].
服务器可能允许修改子模式。[X.501]第14.5节讨论了子模式修改程序。
A server that masters entries and permits clients to modify these entries SHALL implement and provide access to these subschema (sub)entries including providing a 'subschemaSubentry' attribute in each modifiable entry. This is so clients may discover the attributes and object classes that are permitted to be present. It is strongly RECOMMENDED that all other servers implement this as well.
掌握条目并允许客户端修改这些条目的服务器应实现并提供对这些子模式（sub）条目的访问，包括在每个可修改条目中提供“subschemaSubentry”属性。这样客户机就可以发现允许存在的属性和对象类。强烈建议所有其他服务器也实现此功能。
The value of the 'subschemaSubentry' attribute is the name of the subschema (sub)entry holding the subschema controlling the entry.
“subschemaSubentry”属性的值是包含控制该项的子模式的子模式（sub）项的名称。
( 2.5.18.10 NAME 'subschemaSubentry' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )
（2.5.18.10名称“subschemaSubentry”相等区分名称匹配语法1.3.6.1.4.1.1466.115.121.1.12单值无用户修改使用目录操作）
The 'distinguishedNameMatch' matching rule and the DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax are defined in [RFC4517].
[RFC4517]中定义了“DifferentizedNameMatch”匹配规则和DifferentizedName（1.3.6.1.4.1.1466.115.121.1.12）语法。
Subschema is held in (sub)entries belonging to the subschema auxiliary object class.
子模式保存在属于子模式辅助对象类的（子）条目中。
( 2.5.20.1 NAME 'subschema' AUXILIARY MAY ( dITStructureRules $ nameForms $ ditContentRules $ objectClasses $ attributeTypes $ matchingRules $ matchingRuleUse ) )
（2.5.20.1名称“子模式”辅助可能（dITStructureRules$nameForms$ditContentRules$objectClasses$AttributeType$matchingRules$matchingRuleUse））
The 'ldapSyntaxes' operational attribute may also be present in subschema entries.
“ldapSyntaxes”操作属性也可能出现在子模式条目中。
Servers MAY provide additional attributes (described in other documents) in subschema (sub)entries.
服务器可以在子模式（sub）条目中提供附加属性（在其他文档中描述）。
Servers SHOULD provide the attributes 'createTimestamp' and 'modifyTimestamp' in subschema (sub)entries, in order to allow clients to maintain their caches of schema information.
服务器应在子模式（sub）条目中提供属性“createTimestamp”和“modifyTimestamp”，以允许客户端维护其模式信息缓存。
The following subsections provide attribute type definitions for each of schema definition attribute types.
以下小节为每个架构定义属性类型提供属性类型定义。
This attribute holds definitions of object classes.
此属性保存对象类的定义。
( 2.5.21.6 NAME 'objectClasses' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.37 USAGE directoryOperation )
（2.5.21.6名称'ObjectClass'相等objectIdentifierFirstComponentMatch语法1.3.6.1.4.1.1466.115.121.1.37用法目录操作）
The 'objectIdentifierFirstComponentMatch' matching rule and the ObjectClassDescription (1.3.6.1.4.1.1466.115.121.1.37) syntax are defined in [RFC4517].
[RFC4517]中定义了“objectIdentifierFirstComponentMatch”匹配规则和ObjectClassDescription（1.3.6.1.4.1.1466.115.121.1.37）语法。
This attribute holds definitions of attribute types.
此属性保存属性类型的定义。
( 2.5.21.5 NAME 'attributeTypes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 USAGE directoryOperation )
（2.5.21.5名称'AttributeType'相等objectIdentifierFirstComponentMatch语法1.3.6.1.4.1.1466.115.121.1.3用法目录操作）
The 'objectIdentifierFirstComponentMatch' matching rule and the AttributeTypeDescription (1.3.6.1.4.1.1466.115.121.1.3) syntax are defined in [RFC4517].
[RFC4517]中定义了“objectIdentifierFirstComponentMatch”匹配规则和AttributeTypeDescription（1.3.6.1.4.1.1466.115.121.1.3）语法。
This attribute holds definitions of matching rules.
此属性保存匹配规则的定义。
( 2.5.21.4 NAME 'matchingRules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.30 USAGE directoryOperation )
（2.5.21.4名称“匹配规则”相等objectIdentifierFirstComponentMatch语法1.3.6.1.4.1.1466.115.121.1.30使用目录操作）
The 'objectIdentifierFirstComponentMatch' matching rule and the MatchingRuleDescription (1.3.6.1.4.1.1466.115.121.1.30) syntax are defined in [RFC4517].
[RFC4517]中定义了“objectIdentifierFirstComponentMatch”匹配规则和匹配规则描述（1.3.6.1.4.1.1466.115.121.1.30）语法。
This attribute holds definitions of matching rule uses.
此属性保存匹配规则使用的定义。
( 2.5.21.8 NAME 'matchingRuleUse' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.31 USAGE directoryOperation )
（2.5.21.8名称“matchingRuleUse”相等objectIdentifierFirstComponentMatch语法1.3.6.1.4.1.1466.115.121.1.31使用目录操作）
The 'objectIdentifierFirstComponentMatch' matching rule and the MatchingRuleUseDescription (1.3.6.1.4.1.1466.115.121.1.31) syntax are defined in [RFC4517].
匹配规则[IdentificationRuleC4.1.1]中定义的[IdentificationRuleC4.1.1]和[IdentificationRuleC4.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1。
This attribute holds definitions of LDAP syntaxes.
此属性保存LDAP语法的定义。
( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.54 USAGE directoryOperation )
（1.3.6.1.4.1.1466.101.120.16名称'ldapSyntaxes'相等对象标识符FirstComponentMatch语法1.3.6.1.4.1.1466.115.121.1.54使用目录操作）
The 'objectIdentifierFirstComponentMatch' matching rule and the SyntaxDescription (1.3.6.1.4.1.1466.115.121.1.54) syntax are defined in [RFC4517].
[RFC4517]中定义了“objectIdentifierFirstComponentMatch”匹配规则和SyntaxDescription（1.3.6.1.4.1.1466.115.121.1.54）语法。
This attribute lists DIT Content Rules that are present in the subschema.
此属性列出子模式中存在的DIT内容规则。
( 2.5.21.2 NAME 'dITContentRules' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.16 USAGE directoryOperation )
（2.5.21.2名称'dITContentRules'相等objectIdentifierFirstComponentMatch语法1.3.6.1.4.1.1466.115.121.1.16用法目录操作）
The 'objectIdentifierFirstComponentMatch' matching rule and the DITContentRuleDescription (1.3.6.1.4.1.1466.115.121.1.16) syntax are defined in [RFC4517].
[RFC4517]中定义了“objectIdentifierFirstComponentMatch”匹配规则和DITContentRuleDescription（1.3.6.1.4.1.1466.115.121.1.16）语法。
This attribute lists DIT Structure Rules that are present in the subschema.
此属性列出子模式中存在的DIT结构规则。
( 2.5.21.1 NAME 'dITStructureRules' EQUALITY integerFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.17 USAGE directoryOperation )
（2.5.21.1名称“dITStructureRules”相等integerFirstComponentMatch语法1.3.6.1.4.1.1466.115.121.1.17用法目录操作）
The 'integerFirstComponentMatch' matching rule and the DITStructureRuleDescription (1.3.6.1.4.1.1466.115.121.1.17) syntax are defined in [RFC4517].
[RFC4517]中定义了“integerFirstComponentMatch”匹配规则和DITStructureRuleDescription（1.3.6.1.4.1.1466.115.121.1.17）语法。
This attribute lists Name Forms that are in force.
此属性列出有效的名称表单。
( 2.5.21.7 NAME 'nameForms' EQUALITY objectIdentifierFirstComponentMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.35 USAGE directoryOperation )
（2.5.21.7名称'nameForms'相等对象IdentifierFirstComponentMatch语法1.3.6.1.4.1.1466.115.121.1.35使用目录操作）
The 'objectIdentifierFirstComponentMatch' matching rule and the NameFormDescription (1.3.6.1.4.1.1466.115.121.1.35) syntax are defined in [RFC4517].
[RFC4517]中定义了“objectIdentifierFirstComponentMatch”匹配规则和NameFormDescription（1.3.6.1.4.1.1466.115.121.1.35）语法。
The 'extensibleObject' auxiliary object class allows entries that belong to it to hold any user attribute. The set of allowed attribute types of this object class is implicitly the set of all attribute types of userApplications usage.
“extensibleObject”辅助对象类允许属于它的条目保存任何用户属性。此对象类允许的属性类型集隐式地是userApplications用法的所有属性类型集。
( 1.3.6.1.4.1.1466.101.120.111 NAME 'extensibleObject' SUP top AUXILIARY )
（1.3.6.1.4.1.1466.101.120.111名称“可扩展对象”辅助顶部辅助）
The mandatory attributes of the other object classes of this entry are still required to be present, and any precluded attributes are still not allowed to be present.
此条目的其他对象类的强制属性仍然需要存在，并且任何排除的属性仍然不允许存在。
To discover the DN of the subschema (sub)entry holding the subschema controlling a particular entry, a client reads that entry's 'subschemaSubentry' operational attribute. To read schema attributes from the subschema (sub)entry, clients MUST issue a Search operation [RFC4511] where baseObject is the DN of the subschema (sub)entry,
要发现包含控制特定项的子模式的子模式（sub）项的DN，客户机将读取该项的“subschemaSubentry”操作属性。要从子模式（sub）项读取模式属性，客户端必须发出搜索操作[RFC4511]，其中baseObject是子模式（sub）项的DN，
scope is baseObject, filter is "(objectClass=subschema)" [RFC4515], and the attributes field lists the names of the desired schema attributes (as they are operational). Note: the "(objectClass=subschema)" filter allows LDAP servers that gateway to X.500 to detect that subentry information is being requested.
作用域是baseObject，筛选器是“（objectClass=subschema）”[RFC4515]，属性字段列出了所需模式属性的名称（因为它们是可操作的）。注意：“（objectClass=subschema）”过滤器允许作为X.500网关的LDAP服务器检测正在请求的子条目信息。
Clients SHOULD NOT assume that a published subschema is complete, that the server supports all of the schema elements it publishes, or that the server does not support an unpublished element.
客户端不应假定已发布的子模式已完成，服务器支持其发布的所有模式元素，或者服务器不支持未发布的元素。
The LDAP protocol assumes there are one or more servers that jointly provide access to a Directory Information Tree (DIT). The server holding the original information is called the "master" (for that information). Servers that hold copies of the original information are referred to as "shadowing" or "caching" servers.
LDAP协议假定有一个或多个服务器共同提供对目录信息树（DIT）的访问。保存原始信息的服务器称为“主服务器”（用于该信息）。保存原始信息副本的服务器称为“隐藏”或“缓存”服务器。
As defined in [X.501]:
如[X.501]中所定义：
context prefix: The sequence of RDNs leading from the Root of the DIT to the initial vertex of a naming context; corresponds to the distinguished name of that vertex.
上下文前缀：从DIT根到命名上下文初始顶点的RDN序列；对应于该顶点的可分辨名称。
naming context: A subtree of entries held in a single master DSA.
命名上下文：保存在单个主DSA中的条目子树。
That is, a naming context is the largest collection of entries, starting at an entry that is mastered by a particular server, and including all its subordinates and their subordinates, down to the entries that are mastered by different servers. The context prefix is the name of the initial entry.
也就是说，命名上下文是最大的条目集合，从由特定服务器控制的条目开始，包括其所有下属及其下属，一直到由不同服务器控制的条目。上下文前缀是初始条目的名称。
The root of the DIT is a DSA-specific Entry (DSE) and not part of any naming context (or any subtree); each server has different attribute values in the root DSE.
DIT的根是DSA特定条目（DSE），而不是任何命名上下文（或任何子树）的一部分；每个服务器在根DSE中具有不同的属性值。
An LDAP server SHALL provide information about itself and other information that is specific to each server. This is represented as a group of attributes located in the root DSE, which is named with the DN with zero RDNs (whose [RFC4514] representation is as the zero-length string).
LDAP服务器应提供关于其自身的信息以及特定于每台服务器的其他信息。这表示为位于根DSE中的一组属性，该属性用带有零RDN的DN命名（其[RFC4514]表示为零长度字符串）。
These attributes are retrievable, subject to access control and other restrictions, if a client performs a Search operation [RFC4511] with an empty baseObject, scope of baseObject, the filter
如果客户端使用空的baseObject、baseObject的作用域和筛选器执行搜索操作[RFC4511]，则这些属性是可检索的，并受访问控制和其他限制的约束
"(objectClass=*)" [RFC4515], and the attributes field listing the names of the desired attributes. It is noted that root DSE attributes are operational and, like other operational attributes, are not returned in search requests unless requested by name.
“（objectClass=*）”[RFC4515]，以及列出所需属性名称的属性字段。请注意，根DSE属性是可操作的，并且与其他操作属性一样，除非按名称请求，否则不会在搜索请求中返回。
The root DSE SHALL NOT be included if the client performs a subtree search starting from the root.
如果客户端从根开始执行子树搜索，则不应包括根DSE。
Servers may allow clients to modify attributes of the root DSE, where appropriate.
服务器可能允许客户端在适当的情况下修改根DSE的属性。
The following attributes of the root DSE are defined below. Additional attributes may be defined in other documents.
根DSE的以下属性定义如下。其他属性可以在其他文档中定义。
- altServer: alternative servers;
- altServer：备用服务器；
- namingContexts: naming contexts;
- 命名上下文：命名上下文；
- supportedControl: recognized LDAP controls;
- supportedControl：可识别的LDAP控件；
- supportedExtension: recognized LDAP extended operations;
- supportedExtension：可识别的LDAP扩展操作；
- supportedFeatures: recognized LDAP features;
- supportedFeatures：可识别的LDAP功能；
- supportedLDAPVersion: LDAP versions supported; and
- supportedLDAPVersion：支持的LDAP版本；和
- supportedSASLMechanisms: recognized Simple Authentication and Security Layers (SASL) [RFC4422] mechanisms.
- supportedSASLMechanisms：可识别的简单身份验证和安全层（SASL）[RFC4422]机制。
The values provided for these attributes may depend on session-specific and other factors. For example, a server supporting the SASL EXTERNAL mechanism might only list "EXTERNAL" when the client's identity has been established by a lower level. See [RFC4513].
为这些属性提供的值可能取决于特定于会话和其他因素。例如，支持SASL外部机制的服务器可能仅在较低级别建立了客户机身份时才列出“外部”。见[RFC4513]。
The root DSE may also include a 'subschemaSubentry' attribute. If it does, the attribute refers to the subschema (sub)entry holding the schema controlling the root DSE. Clients SHOULD NOT assume that this subschema (sub)entry controls other entries held by the server. General subschema discovery procedures are provided in Section 4.4.
根DSE还可能包括“subschemauseBentry”属性。如果是，则该属性引用包含控制根DSE的模式的子模式（sub）条目。客户端不应假定此子模式（sub）条目控制服务器持有的其他条目。第4.4节提供了一般子模式发现程序。
The 'altServer' attribute lists URIs referring to alternative servers that may be contacted when this server becomes unavailable. URIs for servers implementing the LDAP are written according to [RFC4516]. Other kinds of URIs may be provided. If the server does not know of any other servers that could be used, this attribute will be absent. Clients may cache this information in case their preferred server later becomes unavailable.
“altServer”属性列出了当此服务器不可用时可能会联系的替代服务器的URI。用于实现LDAP的服务器的URI是根据[RFC4516]编写的。可以提供其他类型的uri。如果服务器不知道可以使用任何其他服务器，则此属性将不存在。客户端可以缓存此信息，以防其首选服务器稍后不可用。
( 1.3.6.1.4.1.1466.101.120.6 NAME 'altServer' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 USAGE dSAOperation )
（1.3.6.1.4.1.1466.101.120.6名称“altServer”语法1.3.6.1.4.1.1466.115.121.1.26用法DSAO操作）
The IA5String (1.3.6.1.4.1.1466.115.121.1.26) syntax is defined in [RFC4517].
[RFC4517]中定义了IA5String（1.3.6.1.4.1.1466.115.121.1.26）语法。
The 'namingContexts' attribute lists the context prefixes of the naming contexts the server masters or shadows (in part or in whole). If the server is a first-level DSA [X.501], it should list (in addition) an empty string (indicating the root of the DIT). If the server does not master or shadow any information (e.g., it is an LDAP gateway to a public X.500 directory) this attribute will be absent. If the server believes it masters or shadows the entire directory, the attribute will have a single value, and that value will be the empty string (indicating the root of the DIT).
“namingContexts”属性列出服务器主控或阴影（部分或全部）命名上下文的上下文前缀。如果服务器是一级DSA[X.501]，它应该（另外）列出一个空字符串（指示DIT的根）。如果服务器不掌握或隐藏任何信息（例如，它是公共X.500目录的LDAP网关），则此属性将不存在。如果服务器认为它控制或隐藏整个目录，则该属性将有一个值，该值将是空字符串（指示DIT的根）。
This attribute may be used, for example, to select a suitable entry name for subsequent operations with this server.
例如，可以使用此属性为该服务器的后续操作选择合适的条目名称。
( 1.3.6.1.4.1.1466.101.120.5 NAME 'namingContexts' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 USAGE dSAOperation )
（1.3.6.1.4.1.1466.101.120.5名称“namingContexts”语法1.3.6.1.4.1.1466.115.121.1.12用法DSAO操作）
The DistinguishedName (1.3.6.1.4.1.1466.115.121.1.12) syntax is defined in [RFC4517].
[RFC4517]中定义了区分名称（1.3.6.1.4.1.1466.115.121.1.12）语法。
The 'supportedControl' attribute lists object identifiers identifying the request controls [RFC4511] the server supports. If the server does not support any request controls, this attribute will be absent. Object identifiers identifying response controls need not be listed.
“supportedControl”属性列出了标识服务器支持的请求控制[RFC4511]的对象标识符。如果服务器不支持任何请求控件，则此属性将不存在。标识响应控件的对象标识符不需要列出。
Procedures for registering object identifiers used to discovery of protocol mechanisms are detailed in BCP 64, RFC 4520 [RFC4520].
BCP 64、RFC 4520[RFC4520]中详细介绍了注册用于发现协议机制的对象标识符的过程。
( 1.3.6.1.4.1.1466.101.120.13 NAME 'supportedControl' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )
（1.3.6.1.4.1.1466.101.120.13名称“supportedControl”语法1.3.6.1.4.1.1466.115.121.1.38用法DSAO操作）
The OBJECT IDENTIFIER (1.3.6.1.4.1.1466.115.121.1.38) syntax is defined in [RFC4517].
[RFC4517]中定义了对象标识符（1.3.6.1.4.1.1466.115.121.1.38）语法。
The 'supportedExtension' attribute lists object identifiers identifying the extended operations [RFC4511] that the server supports. If the server does not support any extended operations, this attribute will be absent.
“supportedExtension”属性列出了标识服务器支持的扩展操作[RFC4511]的对象标识符。如果服务器不支持任何扩展操作，则此属性将不存在。
An extended operation generally consists of an extended request and an extended response but may also include other protocol data units (such as intermediate responses). The object identifier assigned to the extended request is used to identify the extended operation. Other object identifiers used in the extended operation need not be listed as values of this attribute.
扩展操作通常包括扩展请求和扩展响应，但也可能包括其他协议数据单元（如中间响应）。分配给扩展请求的对象标识符用于标识扩展操作。扩展操作中使用的其他对象标识符不需要作为该属性的值列出。
Procedures for registering object identifiers used to discovery of protocol mechanisms are detailed in BCP 64, RFC 4520 [RFC4520].
BCP 64、RFC 4520[RFC4520]中详细介绍了注册用于发现协议机制的对象标识符的过程。
( 1.3.6.1.4.1.1466.101.120.7 NAME 'supportedExtension' SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )
（1.3.6.1.4.1.1466.101.120.7名称“supportedExtension”语法1.3.6.1.4.1.1466.115.121.1.38用法dSAOperation）
The OBJECT IDENTIFIER (1.3.6.1.4.1.1466.115.121.1.38) syntax is defined in [RFC4517].
[RFC4517]中定义了对象标识符（1.3.6.1.4.1.1466.115.121.1.38）语法。
The 'supportedFeatures' attribute lists object identifiers identifying elective features that the server supports. If the server does not support any discoverable elective features, this attribute will be absent.
“supportedFeatures”属性列出了标识服务器支持的可选功能的对象标识符。如果服务器不支持任何可发现的可选功能，则此属性将不存在。
( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )
（1.3.6.1.4.1.4203.1.3.5名称“supportedFeatures”相等objectIdentifierMatch语法1.3.6.1.4.1.1466.115.121.1.38用法dSAOperation）
Procedures for registering object identifiers used to discovery of protocol mechanisms are detailed in BCP 64, RFC 4520 [RFC4520].
BCP 64、RFC 4520[RFC4520]中详细介绍了注册用于发现协议机制的对象标识符的过程。
The OBJECT IDENTIFIER (1.3.6.1.4.1.1466.115.121.1.38) syntax and objectIdentifierMatch matching rule are defined in [RFC4517].
[RFC4517]中定义了对象标识符（1.3.6.1.4.1.1466.115.121.1.38）语法和objectIdentifierMatch匹配规则。
The 'supportedLDAPVersion' attribute lists the versions of LDAP that the server supports.
“supportedLDAPVersion”属性列出服务器支持的LDAP版本。
( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 USAGE dSAOperation )
（1.3.6.1.4.1.1466.101.120.15名称“supportedLDAPVersion”语法1.3.6.1.4.1.1466.115.121.1.27使用DSAOOperation）
The INTEGER (1.3.6.1.4.1.1466.115.121.1.27) syntax is defined in [RFC4517].
整数（1.3.6.1.4.1.1466.115.121.1.27）语法在[RFC4517]中定义。
The 'supportedSASLMechanisms' attribute lists the SASL mechanisms [RFC4422] that the server recognizes and/or supports [RFC4513]. The contents of this attribute may depend on the current session state. If the server does not support any SASL mechanisms, this attribute will not be present.
“supportedSASLMechanisms”属性列出服务器识别和/或支持的SASL机制[RFC4422][RFC4513]。此属性的内容可能取决于当前会话状态。如果服务器不支持任何SASL机制，则此属性将不存在。
( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation )
（1.3.6.1.4.1.1466.101.120.14名称“supportedSASLMechanisms”语法1.3.6.1.4.1.1466.115.121.1.15用法DSAO操作）
The Directory String (1.3.6.1.4.1.1466.115.121.1.15) syntax is defined in [RFC4517].
目录字符串（1.3.6.1.4.1.1466.115.121.1.15）语法在[RFC4517]中定义。
Syntaxes may be defined that have specific value and/or value form (representation) preservation requirements. For example, a syntax containing digitally signed data can mandate that the server preserve both the value and form of value presented to ensure that the signature is not invalidated.
可以定义具有特定值和/或值形式（表示）保存要求的语法。例如，包含数字签名数据的语法可以要求服务器保留所显示的值和值的形式，以确保签名不会失效。
Where such requirements have not been explicitly stated, servers SHOULD preserve the value of user information but MAY return the value in a different form. And where a server is unable (or unwilling) to preserve the value of user information, the server SHALL ensure that an equivalent value (per Section 2.3) is returned.
如果未明确说明此类要求，服务器应保留用户信息的价值，但可以以不同的形式返回价值。如果服务器无法（或不愿意）保留用户信息的价值，服务器应确保返回同等价值（根据第2.3节）。
Short names, also known as descriptors, are used as more readable aliases for object identifiers and are used to identify various schema elements. However, it is not expected that LDAP implementations with human user interface would display these short names (or the object identifiers they refer to) to the user. Instead, they would most likely be performing translations (such as expressing the short name in one of the local national languages). For example, the short name "st" (stateOrProvinceName) might be displayed to a German-speaking user as "Land".
短名称（也称为描述符）用作对象标识符的更可读别名，并用于标识各种模式元素。但是，不希望具有人机界面的LDAP实现向用户显示这些短名称（或它们所指的对象标识符）。相反，他们很可能会进行翻译（比如用当地的一种民族语言表达简称）。例如，短名称“st”（stateOrProvinceName）可能会向德语用户显示为“Land”。
The same short name might have different meaning in different subschemas, and, within a particular subschema, the same short name might refer to different object identifiers each identifying a different kind of schema element.
相同的短名称在不同的子模式中可能具有不同的含义，并且在特定的子模式中，相同的短名称可能引用不同的对象标识符，每个标识符标识不同类型的模式元素。
Implementations MUST be prepared that the same short name might be used in a subschema to refer to the different kinds of schema elements. That is, there might be an object class 'x-fubar' and an attribute type 'x-fubar' in a subschema.
实现必须准备好在子模式中使用相同的短名称来引用不同类型的模式元素。也就是说，子模式中可能存在对象类“x-fubar”和属性类型“x-fubar”。
Implementations MUST be prepared that the same short name might be used in the different subschemas to refer to the different schema elements. That is, there might be two matching rules 'x-fubar', each in different subschemas.
实现必须准备好在不同的子模式中使用相同的短名称来引用不同的模式元素。也就是说，可能有两个匹配规则“x-fubar”，每个规则位于不同的子模式中。
Procedures for registering short names (descriptors) are detailed in BCP 64, RFC 4520 [RFC4520].
注册短名称（描述符）的程序详见BCP 64、RFC 4520[RFC4520]。
Some servers may hold cache or shadow copies of entries, which can be used to answer search and comparison queries, but will return referrals or contact other servers if modification operations are requested. Servers that perform shadowing or caching MUST ensure that they do not violate any access control constraints placed on the data by the originating server.
某些服务器可能保存条目的缓存或卷影副本，这些副本可用于回答搜索和比较查询，但如果请求修改操作，则将返回引用或联系其他服务器。执行阴影或缓存的服务器必须确保它们不会违反原始服务器对数据设置的任何访问控制约束。
Servers MUST recognize all names of attribute types and object classes defined in this document but, unless stated otherwise, need not support the associated functionality. Servers SHOULD recognize all the names of attribute types and object classes defined in Section 3 and 4, respectively, of [RFC4519].
服务器必须识别本文档中定义的属性类型和对象类的所有名称，但除非另有说明，否则不需要支持相关功能。应分别识别第519节和第514节中定义的所有属性类的名称和类型。
Servers MUST ensure that entries conform to user and system schema rules or other data model constraints.
服务器必须确保条目符合用户和系统架构规则或其他数据模型约束。
Servers MAY support DIT Content Rules. Servers MAY support DIT Structure Rules and Name Forms.
服务器可能支持DIT内容规则。服务器可能支持DIT结构规则和名称表单。
Servers MAY support alias entries.
服务器可能支持别名条目。
Servers MAY support the 'extensibleObject' object class.
服务器可能支持“extensibleObject”对象类。
Servers MAY support subentries. If so, they MUST do so in accordance with [RFC3672]. Servers that do not support subentries SHOULD use object entries to mimic subentries as detailed in Section 3.2.
服务器可能支持子条目。如果是，则必须按照[RFC3672]的规定进行。不支持子项的服务器应使用对象项来模拟子项，如第3.2节所述。
Servers MAY implement additional schema elements. Servers SHOULD provide definitions of all schema elements they support in subschema (sub)entries.
服务器可以实现额外的模式元素。服务器应该在子模式（sub）条目中提供它们支持的所有模式元素的定义。
In the absence of prior agreements with servers, clients SHOULD NOT assume that servers support any particular schema elements beyond those referenced in Section 7.1. The client can retrieve subschema information as described in Section 4.4.
在没有事先与服务器达成协议的情况下，客户端不应假定服务器支持第7.1节中引用的模式元素之外的任何特定模式元素。客户可以检索第4.4节所述的子模式信息。
Clients MUST NOT display or attempt to decode a value as ASN.1 if the value's syntax is not known. Clients MUST NOT assume the LDAP-specific string encoding is restricted to a UTF-8 encoded string of Unicode characters or any particular subset of Unicode (such as a printable subset) unless such restriction is explicitly stated. Clients SHOULD NOT send attribute values in a request that are not valid according to the syntax defined for the attributes.
如果值的语法未知，客户端不得将该值显示或尝试解码为ASN.1。客户端不得假定特定于LDAP的字符串编码仅限于Unicode字符的UTF-8编码字符串或Unicode的任何特定子集（如可打印子集），除非明确说明了此类限制。根据为属性定义的语法，客户端不应在无效的请求中发送属性值。
Attributes of directory entries are used to provide descriptive information about the real-world objects they represent, which can be people, organizations, or devices. Most countries have privacy laws regarding the publication of information about people.
目录项的属性用于提供有关它们所表示的真实对象的描述性信息，这些对象可以是人、组织或设备。大多数国家都有关于发布个人信息的隐私法。
General security considerations for accessing directory information with LDAP are discussed in [RFC4511] and [RFC4513].
[RFC4511]和[RFC4513]中讨论了使用LDAP访问目录信息的一般安全注意事项。
The Internet Assigned Numbers Authority (IANA) has updated the LDAP descriptors registry as indicated in the following template:
Internet分配号码管理局（IANA）已更新LDAP描述符注册表，如以下模板所示：
Subject: Request for LDAP Descriptor Registration Update Descriptor (short name): see comment Object Identifier: see comment Person & email address to contact for further information: Kurt Zeilenga <kurt@OpenLDAP.org> Usage: see comment Specification: RFC 4512 Author/Change Controller: IESG Comments:
主题：请求LDAP描述符注册更新描述符（简称）：请参阅注释对象标识符：请参阅注释联系人和电子邮件地址以获取更多信息：Kurt Zeilenga<kurt@OpenLDAP.org>用法：参见注释规范：RFC 4512作者/变更控制者：IESG注释：
The following descriptors (short names) has been added to the registry.
以下描述符（简称）已添加到注册表中。
NAME Type OID
------------------------ ---- -----------------
governingStructureRule A 2.5.21.10
structuralObjectClass A 2.5.21.9
NAME Type OID
------------------------ ---- -----------------
governingStructureRule A 2.5.21.10
structuralObjectClass A 2.5.21.9
The following descriptors (short names) have been updated to refer to this RFC.
以下描述符（简称）已更新以引用此RFC。
NAME Type OID
------------------------ ---- -----------------
alias O 2.5.6.1
aliasedObjectName A 2.5.4.1
altServer A 1.3.6.1.4.1.1466.101.120.6
attributeTypes A 2.5.21.5
createTimestamp A 2.5.18.1
creatorsName A 2.5.18.3
dITContentRules A 2.5.21.2
dITStructureRules A 2.5.21.1
extensibleObject O 1.3.6.1.4.1.1466.101.120.111
ldapSyntaxes A 1.3.6.1.4.1.1466.101.120.16
NAME Type OID
------------------------ ---- -----------------
alias O 2.5.6.1
aliasedObjectName A 2.5.4.1
altServer A 1.3.6.1.4.1.1466.101.120.6
attributeTypes A 2.5.21.5
createTimestamp A 2.5.18.1
creatorsName A 2.5.18.3
dITContentRules A 2.5.21.2
dITStructureRules A 2.5.21.1
extensibleObject O 1.3.6.1.4.1.1466.101.120.111
ldapSyntaxes A 1.3.6.1.4.1.1466.101.120.16
matchingRuleUse A 2.5.21.8 matchingRules A 2.5.21.4 modifiersName A 2.5.18.4 modifyTimestamp A 2.5.18.2 nameForms A 2.5.21.7 namingContexts A 1.3.6.1.4.1.1466.101.120.5 objectClass A 2.5.4.0 objectClasses A 2.5.21.6 subschema O 2.5.20.1 subschemaSubentry A 2.5.18.10 supportedControl A 1.3.6.1.4.1.1466.101.120.13 supportedExtension A 1.3.6.1.4.1.1466.101.120.7 supportedFeatures A 1.3.6.1.4.1.4203.1.3.5 supportedLDAPVersion A 1.3.6.1.4.1.1466.101.120.15 supportedSASLMechanisms A 1.3.6.1.4.1.1466.101.120.14 top O 2.5.6.0
匹配规则使用2.5.21.8匹配规则A 2.5.21.4修饰符名称A 2.5.18.4修改时间戳A 2.5.18.2名称形成2.5.21.7命名上下文A 1.3.6.1.4.1.1466.101.120.5对象类A 2.5.4.0对象类A 2.5.21.6子模式O 2.5.20.1子模式A 2.5.18.10支持的控件A 1.3.6.1.4.1.1466.101.120.13支持扩展1.3.6.1.4.1.1466.101.120.7支持的功能包括1.3.6.1.4.1.4203.1.3.5支持的LDAPVersion A 1.3.6.1.4.1466.101.120.15支持的辅助机制A 1.3.6.1.4.1.1466.101.120.14 top O 2.5.6.0
This document is based in part on RFC 2251 by M. Wahl, T. Howes, and S. Kille; RFC 2252 by M. Wahl, A. Coulbeck, T. Howes, S. Kille; and RFC 2556 by M. Wahl, all products of the IETF Access, Searching and Indexing of Directories (ASID) Working Group. This document is also based in part on "The Directory: Models" [X.501], a product of the International Telephone Union (ITU). Additional text was borrowed from RFC 2253 by M. Wahl, T. Howes, and S. Kille.
本文件部分基于M.Wahl、T.Howes和S.Kille的RFC 2251；M.Wahl，A.Coulbeck，T.Howes，S.Kille的RFC 2252；和M.Wahl的RFC 2556，IETF目录访问、搜索和索引（ASID）工作组的所有产品。本文件还部分基于国际电话联盟（ITU）的产品“目录：型号”[X.501]。附加文本由M.Wahl、T.Howes和S.Kille从RFC2253中借用。
This document is a product of the IETF LDAP Revision (LDAPBIS) Working Group.
本文件是IETF LDAP修订（LDAPBIS）工作组的产品。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
[RFC3629]Yergeau，F.，“UTF-8，ISO 10646的转换格式”，STD 63，RFC 3629，2003年11月。
[RFC3671] Zeilenga, K., "Collective Attributes in the Lightweight Directory Access Protocol (LDAP)", RFC 3671, December 2003.
[RFC3671]Zeilenga，K.，“轻量级目录访问协议（LDAP）中的集合属性”，RFC 3671，2003年12月。
[RFC3672] Zeilenga, K., "Subentries in the Lightweight Directory Access Protocol (LDAP)", RFC 3672, December 2003.
[RFC3672]Zeilenga，K.，“轻量级目录访问协议（LDAP）中的子项”，RFC 3672，2003年12月。
[RFC4234] Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", RFC 4234, October 2005.
[RFC4234]Crocker，D.和P.Overell，“语法规范的扩充BNF:ABNF”，RFC 4234，2005年10月。
[RFC4422] Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple Authentication and Security Layer (SASL)", RFC 4422, June 2006.
[RFC4422]Melnikov，A.，Ed.和K.Zeilenga，Ed.，“简单身份验证和安全层（SASL）”，RFC 4422，2006年6月。
[RFC4510] Zeilenga, K., Ed., "Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map", RFC 4510, June 2006.
[RFC4510]Zeilenga，K.，Ed.“轻量级目录访问协议（LDAP）：技术规范路线图”，RFC45102006年6月。
[RFC4511] Sermersheim, J., Ed., "Lightweight Directory Access Protocol (LDAP): The Protocol", RFC 4511, June 2006.
[RFC4511]Sermersheim，J.，Ed.，“轻量级目录访问协议（LDAP）：协议”，RFC4511，2006年6月。
[RFC4513] Harrison, R., Ed., "Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms", RFC 4513, June 2006.
[RFC4513]Harrison，R.，Ed.“轻量级目录访问协议（LDAP）：身份验证方法和安全机制”，RFC4513，2006年6月。
[RFC4514] Zeilenga, K., Ed., "Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names", RFC 4514, June 2006.
[RFC4514]Zeilenga，K.，Ed.“轻量级目录访问协议（LDAP）：可分辨名称的字符串表示”，RFC4514，2006年6月。
[RFC4515] Smith, M., Ed. and T. Howes, "Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters", RFC 4515, June 2006.
[RFC4515]Smith，M.，Ed.和T.Howes，“轻量级目录访问协议（LDAP）：搜索过滤器的字符串表示”，RFC45152006年6月。
[RFC4516] Smith, M., Ed. and T. Howes, "Lightweight Directory Access Protocol (LDAP): Uniform Resource Locator", RFC 4516, June 2006.
[RFC4516]Smith，M.，Ed.和T.Howes，“轻量级目录访问协议（LDAP）：统一资源定位器”，RFC4516，2006年6月。
[RFC4517] Legg, S., Ed., "Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules", RFC 4517, June 2006.
[RFC4517]Legg，S.，Ed.，“轻量级目录访问协议（LDAP）：语法和匹配规则”，RFC4517，2006年6月。
[RFC4519] Sciberras, A., Ed., "Lightweight Directory Access Protocol (LDAP): Schema for User Applications", RFC 4519, June 2006.
[RFC4519]Sciberras，A.，Ed.，“轻量级目录访问协议（LDAP）：用户应用程序模式”，RFC4519，2006年6月。
[RFC4520] Zeilenga, K., "Internet Assigned Numbers Authority (IANA) Considerations for the Lightweight Directory Access Protocol (LDAP)", BCP 64, RFC 4520, June 2006.
[RFC4520]Zeilenga，K.，“轻量级目录访问协议（LDAP）的互联网分配号码管理局（IANA）注意事项”，BCP 64，RFC 4520，2006年6月。
[Unicode] The Unicode Consortium, "The Unicode Standard, Version 3.2.0" is defined by "The Unicode Standard, Version 3.0" (Reading, MA, Addison-Wesley, 2000. ISBN 0-201- 61633-5), as amended by the "Unicode Standard Annex #27: Unicode 3.1" (http://www.unicode.org/reports/tr27/) and by the "Unicode Standard Annex #28: Unicode 3.2" (http://www.unicode.org/reports/tr28/).
[Unicode]Unicode联盟“Unicode标准，版本3.2.0”由“Unicode标准，版本3.0”（雷丁，马萨诸塞州，Addison-Wesley，2000.ISBN 0-201-61633-5）定义，并由“Unicode标准附录27:Unicode 3.1”修订(http://www.unicode.org/reports/tr27/)根据“Unicode标准附录28:Unicode 3.2”(http://www.unicode.org/reports/tr28/).
[X.500] International Telecommunication Union - Telecommunication Standardization Sector, "The Directory -- Overview of concepts, models and services," X.500(1993) (also ISO/IEC 9594-1:1994).
[X.500]国际电信联盟-电信标准化部门，“目录——概念、模型和服务概述”，X.500（1993）（也指ISO/IEC 9594-1:1994）。
[X.501] International Telecommunication Union - Telecommunication Standardization Sector, "The Directory -- Models," X.501(1993) (also ISO/IEC 9594- 2:1994).
[X.501]国际电信联盟-电信标准化部门，“目录——模型”，X.501（1993）（也指ISO/IEC 9594-2:1994）。
[X.680] International Telecommunication Union - Telecommunication Standardization Sector, "Abstract Syntax Notation One (ASN.1) - Specification of Basic Notation", X.680(2002) (also ISO/IEC 8824-1:2002).
[X.680]国际电信联盟-电信标准化部门，“抽象语法符号1（ASN.1）-基本符号规范”，X.680（2002）（也称ISO/IEC 8824-1:2002）。
This appendix is non-normative.
本附录为非规范性附录。
This document amounts to nearly a complete rewrite of portions of RFC 2251, RFC 2252, and RFC 2256. This rewrite was undertaken to improve overall clarity of technical specification. This appendix provides a summary of substantive changes made to the portions of these documents incorporated into this document. Readers should consult [RFC4510], [RFC4511], [RFC4517], and [RFC4519] for summaries of remaining portions of these documents.
本文档几乎完全重写了RFC 2251、RFC 2252和RFC 2256的部分内容。本重写旨在提高技术规范的整体清晰度。本附录概述了对纳入本文件的这些文件部分所做的实质性更改。读者应查阅[RFC4510]、[RFC4511]、[RFC4517]和[RFC4519]以了解这些文件其余部分的摘要。
This document incorporates from RFC 2251, Sections 3.2 and 3.4, and portions of Sections 4 and 6 as summarized below.
本文件包含RFC 2251第3.2节和第3.4节以及下文总结的第4节和第6节的部分内容。
Section 3.2 of RFC 2251 provided a brief introduction to the X.500 data model, as used by LDAP. The previous specification relied on [X.501] but lacked clarity in how X.500 models are adapted for use by LDAP. This document describes the X.500 data models, as used by LDAP, in greater detail, especially in areas where adaptation is needed.
RFC 2251的第3.2节简要介绍了LDAP使用的X.500数据模型。以前的规范依赖于[X.501]，但在如何调整X.500模型以供LDAP使用方面缺乏明确性。本文档更详细地描述了LDAP使用的X.500数据模型，特别是在需要调整的领域。
Section 3.2.1 of RFC 2251 described an attribute as "a type with one or more associated values". In LDAP, an attribute is better described as an attribute description, a type with zero or more options, and one or more associated values.
RFC 2251第3.2.1节将属性描述为“具有一个或多个关联值的类型”。在LDAP中，属性最好描述为属性描述、具有零个或多个选项的类型以及一个或多个关联值。
Section 3.2.2 of RFC 2251 mandated that subschema subentries contain objectClasses and attributeTypes attributes, yet X.500(93) treats these attributes as optional. While generally all implementations that support X.500(93) subschema mechanisms will provide both of these attributes, it is not absolutely required for interoperability that all servers do. The mandate was removed for consistency with X.500(93). The subschema discovery mechanism was also clarified to indicate that subschema controlling an entry is obtained by reading the (sub)entry referred to by that entry's 'subschemaSubentry' attribute.
RFC 2251第3.2.2节规定子模式子项包含ObjectClass和AttributeType属性，但X.500（93）将这些属性视为可选属性。虽然通常所有支持X.500（93）子模式机制的实现都将提供这两个属性，但并非所有服务器都绝对需要互操作性。为了与X.500（93）保持一致，取消了授权。子模式发现机制也被阐明，以表明控制一个条目的子模式是通过读取该条目的“subschemaSubentry”属性所引用的（子）条目获得的。
Section 3.4 of RFC 2251 provided "Server-specific Data Requirements". This material, with changes, was incorporated in Section 5.1 of this document.
RFC 2251第3.4节提供了“服务器特定数据要求”。本材料及其变更已纳入本文件第5.1节。
Changes:
变化：
- Clarify that attributes of the root DSE are subject to "other restrictions" in addition to access controls.
- 澄清根DSE的属性除访问控制外还受“其他限制”。
- Clarify that only recognized extended requests need to be enumerated 'supportedExtension'.
- 澄清只需枚举已识别的扩展请求“supportedExtension”。
- Clarify that only recognized request controls need to be enumerated 'supportedControl'.
- 澄清仅需枚举已识别的请求控件“supportedControl”。
- Clarify that root DSE attributes are operational and, like other operational attributes, will not be returned in search requests unless requested by name.
- 澄清根DSE属性是可操作的，并且与其他操作属性一样，除非按名称请求，否则不会在搜索请求中返回。
- Clarify that not all root DSE attributes are user modifiable.
- 澄清并非所有根DSE属性都是用户可修改的。
- Remove inconsistent text regarding handling of the 'subschemaSubentry' attribute within the root DSE. The previous specification stated that the 'subschemaSubentry' attribute held in the root DSE referred to "subschema entries (or subentries) known by this server". This is inconsistent with the attribute's intended use as well as its formal definition as a single valued attribute [X.501]. It is also noted that a simple (possibly incomplete) list of subschema (sub)entries is not terribly useful. This document (in Section 5.1) specifies that the 'subschemaSubentry' attribute of the root DSE refers to the subschema controlling the root DSE. It is noted that the general subschema discovery mechanism remains available (see Section 4.4 of this document).
- 删除根DSE中有关处理“subschemauseBentry”属性的不一致文本。先前的规范指出，根DSE中保存的“subschemaSubentry”属性指的是“此服务器已知的子模式条目（或子条目）”。这与属性的预期用途及其作为单值属性的形式定义不一致[X.501]。还需要注意的是，子模式（sub）条目的简单（可能不完整）列表并不是非常有用。本文件（第5.1节）规定，根DSE的“subschemaSubentry”属性指控制根DSE的子模式。需要注意的是，通用子模式发现机制仍然可用（见本文件第4.4节）。
Portions of Section 4 of RFC 2251 detailing aspects of the information model used by LDAP were incorporated in this document, including:
RFC 2251第4节中详细说明LDAP使用的信息模型方面的部分包含在本文件中，包括：
- Restriction of distinguished values to attributes whose descriptions have no options (from Section 4.1.3);
- 将可分辨值限制在描述无选项的属性上（见第4.1.3节）；
- Data model aspects of Attribute Types (from Section 4.1.4), Attribute Descriptions (from 4.1.5), Attribute (from 4.1.8), Matching Rule Identifier (from 4.1.9); and
- 属性类型（第4.1.4节）、属性描述（第4.1.5节）、属性（第4.1.8节）、匹配规则标识符（第4.1.9节）的数据模型方面；和
- User schema requirements (from Sections 4.1.6, 4.5.1, and 4.7).
- 用户模式要求（来自第4.1.6、4.5.1和4.7节）。
Clarifications to these portions include:
对这些部分的澄清包括：
- Subtyping and AttributeDescriptions with options.
- 带有选项的子类型和属性说明。
The Section 6.1 and the second paragraph of Section 6.2 of RFC 2251 where incorporated into this document.
纳入本文件的RFC 2251第6.1节和第6.2节第二段。
This document incorporates Sections 4, 5, and 7 from RFC 2252.
本文件包含RFC 2252第4、5和7节。
The specification was updated to use Augmented BNF [RFC4234]. The string representation of an OBJECT IDENTIFIER was tightened to disallow leading zeros as described in RFC 2252.
该规范已更新为使用增广BNF[RFC4234]。对象标识符的字符串表示被严格限制为不允许前导零，如RFC2252中所述。
The <descr> syntax was changed to disallow semicolon (U+003B) characters in order to appear to be consistent its natural language specification "descr is the syntactic representation of an object descriptor, which consists of letters and digits, starting with a letter". In a related change, the statement "an AttributeDescription can be used as the value in a NAME part of an AttributeTypeDescription" was deleted. RFC 2252 provided no specification of the semantics of attribute options appearing in NAME fields.
<descr>语法被更改为不允许分号（U+003B）字符，以使其与自然语言规范“descr是对象描述符的语法表示，由字母和数字组成，以字母开头”。在相关更改中，删除了语句“AttributeDescription可以用作AttributeTypeDescription的名称部分中的值”。RFC2252未提供名称字段中出现的属性选项的语义规范。
RFC 2252 stated that the <descr> form of <oid> SHOULD be preferred over the <numericoid> form. However, <descr> form can be ambiguous. To address this issue, the imperative was replaced with a statement (in Section 1.4) that while the <descr> form is generally preferred, <numericoid> should be used where an unambiguous <descr> is not available. Additionally, an expanded discussion of descriptor issues is in Section 6.2 ("Short Names").
RFC 2252规定<descr>形式的<oid>应优先于<numericoid>形式。但是，<descr>表单可能不明确。为了解决这个问题，命令被替换为一个声明（在第1.4节中），即虽然通常首选<descr>形式，但在没有明确<descr>的情况下应使用<numericoid>。此外，第6.2节（“短名称”）对描述符问题进行了详细讨论。
The ABNF for a quoted string (qdstring) was updated to reflect support for the escaping mechanism described in Section 4.3 of RFC 2252.
已更新带引号字符串（qdstring）的ABNF，以反映对RFC 2252第4.3节所述转义机制的支持。
Definitions of operational attributes provided in Section 5 of RFC 2252 where incorporated into this document.
RFC 2252第5节中提供的操作属性定义，其中包含在本文件中。
The 'namingContexts' description was clarified. A first-level DSA should publish, in addition to other values, "" indicating the root of the DIT.
澄清了“namingContexts”的描述。除其他值外，第一级DSA还应发布“”以指示DIT的根目录。
The 'altServer' description was clarified. It may hold any URI.
“altServer”描述已澄清。它可以包含任何URI。
The 'supportedExtension' description was clarified. A server need only list the OBJECT IDENTIFIERs associated with the extended requests of the extended operations it recognizes.
澄清了“supportedExtension”描述。服务器只需要列出与它识别的扩展操作的扩展请求相关联的对象标识符。
The 'supportedControl' description was clarified. A server need only list the OBJECT IDENTIFIERs associated with the request controls it recognizes.
澄清了“supportedControl”的描述。服务器只需要列出与它识别的请求控件关联的对象标识符。
Descriptions for the 'structuralObjectClass' and 'governingStructureRule' operational attribute types were added.
添加了“StructureObjectClass”和“governingStructureRule”操作属性类型的说明。
The attribute definition of 'subschemaSubentry' was corrected to list the terms SINGLE-VALUE and NO-USER-MODIFICATION in proper order.
“子模式”的属性定义已更正，以按适当顺序列出术语单值和无用户修改。
Section 7 of RFC 2252 provides definitions of the 'subschema' and 'extensibleObject' object classes. These definitions where integrated into Section 4.2 and Section 4.3 of this document, respectively. Section 7 of RFC 2252 also contained the object class implementation requirement. This was incorporated into Section 7 of this document.
RFC2252的第7节提供了“子模式”和“可扩展对象”对象类的定义。这些定义分别纳入本文件第4.2节和第4.3节。RFC2252的第7节还包含了对象类实现需求。这已纳入本文件第7节。
The specification of 'extensibleObject' was clarified regarding how it interacts with precluded attributes.
“extensibleObject”的规范就其如何与排除的属性交互进行了澄清。
This document incorporates Sections 5.1, 5.2, 7.1, and 7.2 of RFC 2256.
本文件包含RFC 2256第5.1、5.2、7.1和7.2节。
Section 5.1 of RFC 2256 provided the definition of the 'objectClass' attribute type. This was integrated into Section 2.4.1 of this document. The statement "One of the values is either 'top' or 'alias'" was replaced with statement that one of the values is 'top' as entries belonging to 'alias' also belong to 'top'.
RFC 2256的第5.1节提供了“objectClass”属性类型的定义。这已纳入本文件第2.4.1节。语句“其中一个值为'top'或'alias'”已替换为其中一个值为'top'的语句，因为属于'alias'的条目也属于'top'。
Section 5.2 of RFC 2256 provided the definition of the 'aliasedObjectName' attribute type. This was integrated into Section 2.6.2 of this document.
RFC 2256的第5.2节提供了“aliasedObjectName”属性类型的定义。这已纳入本文件第2.6.2节。
Section 7.1 of RFC 2256 provided the definition of the 'top' object class. This was integrated into Section 2.4.1 of this document.
RFC 2256的第7.1节提供了“top”对象类的定义。这已纳入本文件第2.4.1节。
Section 7.2 of RFC 2256 provided the definition of the 'alias' object class. This was integrated into Section 2.6.1 of this document.
RFC 2256的第7.2节提供了“别名”对象类的定义。这已纳入本文件第2.6.1节。
This document made no substantive change to the 'supportedFeatures' technical specification provided in RFC 3674.
本文件未对RFC 3674中提供的“支持功能”技术规范进行实质性更改。
Editor's Address
编辑地址
Kurt D. Zeilenga OpenLDAP Foundation
库尔特D.Zeeliga OpenLDAP基金会
EMail: Kurt@OpenLDAP.org
EMail: Kurt@OpenLDAP.org
Full Copyright Statement
完整版权声明
Copyright (C) The Internet Society (2006).
版权所有（C）互联网协会（2006年）。
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
本文件受BCP 78中包含的权利、许可和限制的约束，除其中规定外，作者保留其所有权利。
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件及其包含的信息是按“原样”提供的，贡献者、他/她所代表或赞助的组织（如有）、互联网协会和互联网工程任务组不承担任何明示或暗示的担保，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Intellectual Property
知识产权
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
IETF对可能声称与本文件所述技术的实施或使用有关的任何知识产权或其他权利的有效性或范围，或此类权利下的任何许可可能或可能不可用的程度，不采取任何立场；它也不表示它已作出任何独立努力来确定任何此类权利。有关RFC文件中权利的程序信息，请参见BCP 78和BCP 79。
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
向IETF秘书处披露的知识产权副本和任何许可证保证，或本规范实施者或用户试图获得使用此类专有权利的一般许可证或许可的结果，可从IETF在线知识产权存储库获取，网址为http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
IETF邀请任何相关方提请其注意任何版权、专利或专利申请，或其他可能涵盖实施本标准所需技术的专有权利。请将信息发送至IETF的IETF-ipr@ietf.org.
Acknowledgement
确认
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA).
RFC编辑器功能的资金由IETF行政支持活动（IASA）提供。