Appendix A - LDAP: Data Types

LDAP supports a sub-set (a pretty chunky sub-set) of the X.500 data types. Each data type is defined by its syntax (full list of OpenLDAP supported syntaxes). We define the most interesting ones in some detail.

LDAP does some nifty things when comparing and searching attributes - some notes.

Strings
Numbers (Integer)
Time
Telephone Numbers
Boolean
Binary
Distinguished Name
Bit Strings
LDAP Supported Syntaxes

LDAP Strings

The most common type of data is contained in strings - the bad news is there are a number of string types.

IA5String (OID=1.3.6.1.4.1.1466.115.121.1.26) IA5 (almost ASCII) character set (7-bit). Does NOT allow extended characters e.g. é, Ø, å etc.
DirectoryString (OID=1.3.6.1.4.1.1466.115.121.1.15) UTF-8 encoding of ISO-10646 (Unicode) - a variable byte encoding system that includes IA5/ASCII as a subset - grubby details. DOES include extended characters e.g. é, Ø, å etc. Allows matchingRules of caseIgnoreMatch and caseIgnoreSubstringsMatch.
PrintableString (OID=1.3.6.1.4.1.1466.115.121.1.44) IA5 (almost ASCII) string but limited to characters defined in RFC 2252 section 4.1 production p. Does NOT allow extended characters, for instance, é, Ø, å etc. Allows matchingRules of caseIgnoreMatch and caseIgnoreSubstringsMatch.
OctetString (OID=1.3.6.1.4.1.1466.115.121.1.40) are treated as transparent 8-bit bytes. They may, or may not, be printable or human readable. Typically used by passwords. Allows matchingRules of octetStringMatch and octetStringOrderingMatch.
PostalAddress (OID=1.3.6.1.4.1.1466.115.121.1.41) a special format which uses UTF-8 encoding of ISO-10646 (Unicode) separated by '$' used for generating printable labels or other output. DOES allow extended characters e.g. é, Ø, å etc. Allows matchingRules of caseIgnoreListMatch and caseIgnoreListSubstringsMatch.
CountryString (OID=1.3.6.1.4.1.1466.115.121.1.11) special field uses IA5 (almost ASCII) character set but limited to exactly two characters describing the ISO 3166 country code. Use friendlyCountryName if full country name required. Allows matchingRules of caseIgnoreMatch and caseIgnoreSubstringsMatch.
NumericString (OID=1.3.6.1.4.1.1466.115.121.1.36) uses a numeric subset (RFC 2252 section 4.1 production d) of the IA5 (almost ASCII) character set. Allows matchingRules of numericStringMatch and numericStringSubstringsMatch.

LDAP Numbers

Numeric values are actually stored as strings, but can, if an ORDERING matching rule is defined in the attribute definition, allow numeric comparisons, that is, 100 > 2. The Integer type defines a 32 bit signed value and thus may take values in the range 2³¹-1 (2,147,483,647) to -2³¹ (2,147,483,648).

Integer (OID=1.3.6.1.4.1.1466.115.121.1.27) Allows matchingRules of integerMatch (EQUALITY) and integerOrderingMatch (ORDERING).

The standard schemas contain few integer attributes - most numeric fields use one of the string types above - and specifically the NumericString type.

LDAP Time Formats

GeneralizedTime (OID=1.3.6.1.4.1.1466.115.121.1.24) Allows matchingRules of generalizedTimeMatch and generalizedTimeOrderingMatch.

LDAP Telephone Numbers

TelephoneNumber (OID=1.3.6.1.4.1.1466.115.121.1.50) Allows matchingRules of telephoneNumberMatch and telephoneNumberSubstringsMatch.

LDAP Boolean

Boolean (OID=1.3.6.1.4.1.1466.115.121.1.7) Allows a matchingRule of booleanMatch.

LDAP Binary

Binary (OID=1.3.6.1.4.1.1466.115.121.1.5) There are no matchingRules for binary attributes.

LDAP Distinguished Name

DN (OID=1.3.6.1.4.1.1466.115.121.1.12) Allows a matchingRule of distinguishedNameMatch.

LDAP Bits Strings

DN (OID=1.3.6.1.4.1.1466.115.121.1.6) Allows a matchingRule of bitStringMatch.

OpenLDAP Syntaxes supported

This list below defines all supported syntaxes in OpenLDAP. This list is obtainable via the rootDSE subschema. Use this life-saving site to find the OID definition.

The list below may be obtained using the following command:

ldapsearch -H ldap://ldap.mydomain.com -x -s base -b "cn=subschema" ldapsyntaxes
# the list of attributes that may be listed are
# matchingruleuse objectclasses matchingrules attributetypes
# the above entries are collections
# createtimestamp modifytimestamp
# if you use + alone you will get a huge list of 
# everything the LDAP server knows about.

# Subschema
dn: cn=Subschema
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.4 
  DESC 'Audio' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.5 
  DESC 'Binary' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.6 
  DESC 'Bit String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.7 
  DESC 'Boolean' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.8 
  DESC 'Certificate' X-BINARY-TRANSFER-REQUIRED
  'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.9 
  DESC 'Certificate List' X-BINARY-TRANSFER-REQUIRED
  'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.10
  DESC 'Certificate Pair' X-BINARY-TRANSFER-REQUIRED
  'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.11
  DESC 'Country String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.12
  DESC 'Distinguished Name' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.15
  DESC 'Directory String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.22
  DESC 'Facsimile Telephone Number' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.24
  DESC 'Generalized Time' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.26
  DESC 'IA5 String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.27
  DESC 'Integer' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.28
  DESC 'JPEG' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.34
  DESC 'Name And Optional UID' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.36
  DESC 'Numeric String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.38
  DESC 'OID' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.39
  DESC 'Other Mailbox' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.40
  DESC 'Octet String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.41
  DESC 'Postal Address' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.44
  DESC 'Printable String' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.49
  DESC 'Supported Algorithm' X-BINARY-TRANSFER-REQUIRED
  'TRUE' X-NOT-HUMAN-READABLE 'TRUE' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.50
  DESC 'Telephone Number' )
ldapSyntaxes: ( 1.3.6.1.4.1.1466.115.121.1.52
  DESC 'Telex Number' )
ldapSyntaxes: ( 1.3.6.1.1.1.0.0 DESC 'RFC2307
  NIS Netgroup Triple' )
ldapSyntaxes: ( 1.3.6.1.1.1.0.1
  DESC 'RFC2307 Boot Parameter' )
ldapSyntaxes: ( 1.2.826.0.1.3344810.7.1
  DESC 'Serial Number and Issuer' )

Problems, comments, suggestions, corrections (including broken links) or something to add? Please take the time from a busy life to 'mail us' (at top of screen), the webmaster (below) or info-support at zytrax. You will have a warm inner glow for the rest of the day.