# LDAP IETF report {#ldap-ietf-report .unnumbered}

## Status  {#status .unnumbered}

> This document presents a report on recent IETF directory activities
> and is for informational purposes only.

## Abstract {#abstract .unnumbered}

> GIS relies heavily on LDAP, the IETF's directory protocol. This
> document offers an introduction to the current (2001) LDAP standards
> working groups in the IETF, and some remarks about directory
> applications in a few other working groups.

## Table of Contents {#table-of-contents .unnumbered}

[***LDAP IETF report 1***](#ldap-ietf-report)

[Status 1](#status)

[Abstract 1](#abstract)

[Table of Contents 1](#table-of-contents)

[1 Introduction 2](#introduction)

[2 IETF Groups 2](#ietf-groups)

[3 LDAPEXT 2](#ldapext)

[3.1 Description of the Group 2](#description-of-the-group)

[3.2 Charter 3](#charter)

[3.2.1 Description of Working Group: 3](#description-of-working-group)

[3.2.2 Goals and Milestones: 3](#goals-and-milestones)

[3.2.3 Internet-Drafts: 3](#internet-drafts)

[3.2.4 Request For Comments: 3](#request-for-comments)

[4 LDAPBIS 4](#ldapbis)

[4.1 Description of the Group 4](#description-of-the-group-1)

[4.2 Charter 4](#charter-1)

[4.2.1 Description of Working Group: 4](#description-of-working-group-1)

[4.2.2 Goals and Milestones: 4](#goals-and-milestones-1)

[4.2.3 Internet-Drafts: 4](#internet-drafts-1)

[5 LDUP 4](#ldup)

[5.1 Description of the Group 4](#description-of-the-group-2)

[5.2 Charter 5](#charter-2)

[5.2.1 Description of Working Group: 5](#description-of-working-group-2)

[5.2.2 Goals and Milestones: 5](#goals-and-milestones-2)

[5.2.3 Internet-Drafts: 6](#internet-drafts-2)

[6 PKIX 6](#pkix)

[6.1 Description of the Group 6](#description-of-the-group-3)

[7 Other 6](#other)

[8 Conclusion 6](#conclusion)

[Editor\'s Address 6](#editors-address)

[References 6](#references)

# Introduction

> GIS relies heavily LDAP, the Lightweight Directory Access Protocol.
> LDAP has been developed in the IETF (Internet Engineering Task Force)
> organization. Originally an extension of X.500 for use in an IP
> networking environment, LDAP has largely superseded X.500. LDAP and
> X.500 are still evolving in their respective standards organizations.
> This report summarizes the current (2001) status of relevant working
> groups in IETF.
>
> The Internet Engineering Task Force (IETF) meets three times a year.
> More information on IETF can be found at the web site:
> <http://www.ietf.org/>. The meeting cycle in the last several years is
> two meetings in the US, one non-US. The most recent meetings are :
>
> 49^th^ IETF -- San Diego, CA, US Dec 2000
>
> 50^th^ IETF -- Minneapolis MN, US Mar 2001
>
> 51^st^ IETF -- London, England, UK Aug 2001
>
> 52^nd^ IETF -- Salt Lake City UT, US Dec 2001
>
> 53rd IETF -- Minneapolis MN, US Mar 2002
>
> Three working groups in the [applications
> area](http://www.ietf.org/html.charters/wg-dir.html#Applications_Area)
> focus on LDAP: LDAPBIS, LDAPEXT, and LDUP. There are many groups
> working on topics of interest to GIS. This report focuses on these
> Directory groups, and touches lightly on PKIX. There are other groups
> that merit attention from GISWG: SNMP, DNSOPS, IMPP (instant
> messaging) among others.
>
> The directory groups are working on a number of extensions and updates
> to the LDAP standard that should be of interest to GISWG. The
> organization of these IETF working groups is also a valuable model for
> GISWG (not suitable in every way, however).
>
> This document will be supplemented with reports at Gridforum, when
> warranted and when time permits.

# IETF Groups

> A pointer to the group's URL is given, followed by an appraisal of its
> charter. The charter is then quoted in part, including a list of
> upcoming milestones. The list of documents which follows shows current
> drafts, and RFC's, which constitute the working group's completed
> product.

# LDAPEXT

## Description of the Group

> <http://www.ietf.org/html.charters/ldapext-charter.html>
>
> This group is one of the "successor" groups to the original LDAPv3
> group. Its purpose is to manage some standards work that was too
> complex or too immature in development at the time the LDAPv3 drafts
> were completed and would have slowed the approval of LDAP as a
> standard. Ironically, LDAPv3 has been blocked from Draft Standard
> status by a security issue (see LDAPBIS).
>
> There are quite a large number of drafts outstanding. Among the more
> interesting ones for GIS: Persistent Search, SASL Authentication,
> Server-Side Sorting, and service location.
>
> Many drafts have advanced to RFC status but several of these RFC's are
> either informational or are dead ends. Some drafts have been in draft
> status a long time and have waxed and waned in urgency.
>
> There are a number of drafts and RFC's that should be of interest to
> GISWG:
>
> Persistent Search -- this draft may shift to LDUP and/or re-appear
> there in another form. More information about this should be available
> late summer 2001.
>
> The access control set -- this area is in development in the Grid
>
> SASL mechanism -- this extension is in development in the Grid (will
> appear in the Globus Toolkit directory).
>
> Dynamic LDAP -- some interest has been expressed in using this in Grid
> directories.

## Charter

### Description of Working Group: 

> \[This charter is too long (and too out of date) to repeat here.\]

### Goals and Milestones:

> \[The milestone section is long out of date.\].

### Internet-Drafts: 

> [The Java LDAP Application Program
> Interface](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-ldap-java-api-15.txt)
>
> [LDAP Extensions for Scrolling View Browsing of Search
> Results](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-ldapv3-vlv-04.txt)
>
> [Persistent Search: A Simple LDAP Change Notification
> Mechanism](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-psearch-03.txt)
>
> [The C LDAP Application Program
> Interface](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-ldap-c-api-05.txt)
>
> [Access Control Model for
> LDAP](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-acl-model-08.txt)
>
> [X.509 Authentication SASL
> Mechanism](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-x509-sasl-03.txt)
>
> [LDAP Control for a Duplicate Entry Representation of Search
> Results](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-ldapv3-dupent-06.txt)
>
> [Returning Matched Values with
> LDAPv3](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-matchedval-05.txt)
>
> [A Taxonomoy of Methods for LDAP Clients Finding
> Servers](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-ldap-taxonomy-04.txt)
>
> [Discovering LDAP Services with
> DNS](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-locate-05.txt)
>
> [Connection-less Lightweight Directory Access
> Protocol](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-cldap-01.txt)
>
> [Lightweight Directory Access Protocol over
> UDP/IP](http://www.ietf.org/internet-drafts/draft-ietf-ldapext-ldapudp-00.txt)
>
> \[Note: these documents and their URL's change over time.\]

### Request For Comments: 

> [Lightweight Directory Access Protocol (v3): Extensions for Dynamic
> Directory Services (RFC 2589)](http://www.ietf.org/rfc/rfc2589.txt)
>
> [Use of Language Codes in LDAP (RFC
> 2596)](http://www.ietf.org/rfc/rfc2596.txt)
>
> [An LDAP Control and Schema for Holding Operation Signatures (RFC
> 2649)](http://www.ietf.org/rfc/rfc2649.txt)
>
> [LDAP Control Extension for Simple Paged Results Manipulation (RFC
> 2696)](http://www.ietf.org/rfc/rfc2696.txt)
>
> [Access Control Requirements for LDAP (RFC
> 2820)](http://www.ietf.org/rfc/rfc2820.txt)
>
> [Authentication Methods for LDAP (RFC
> 2829)](http://www.ietf.org/rfc/rfc2829.txt)
>
> [Lightweight Directory Access Protocol (v3): Extension for Transport
> Layer Security (RFC 2830)](http://www.ietf.org/rfc/rfc2830.txt)
>
> [LDAP Control Extension for Server Side Sorting of Search Results (RFC
> 2891)](http://www.ietf.org/rfc/rfc2891.txt)

# LDAPBIS

## Description of the Group

> <http://www.ietf.org/html.charters/ldapbis-charter.html>
>
> This group arose to resolve two issues: (1) Just what is LDAPv3 \--
> which set of standards describe it and which are extensions? and (2)
> Remove the IESG security disclaimer and advance LDAPv3 to Draft
> Standard status. The acceptance of security RFC's 2829-2831 should
> allow a resolution to (2).
>
> In addition, it was time to fix some "bugs" in the original LDAPv3
> standards documents, refining the language, definitions, removing some
> inconsistencies, and resolving some outstanding problems (old IANA
> business, X.500 conflicts).
>
> This group excludes innovations as part of its charter, except for the
> necessary security RFC's. GISWG is probably more concerned with
> extensions than with the foundations of LDAP, which has been accepted
> as useful standard. However, the data model draft (replacement for RFC
> 2252) will probably be of interest once it appears, as it will clear
> up some ambiguities and conflicts with X.501 \[X501\].

## Charter

### Description of Working Group: 

> The LDAPv3 \"core\" specification is RFC 2251-2256 and 2829-2831. The
> purpose of this working group is to shepherd these RFCs through the
> Internet Standard process.
>
> The group will deliver revised LDAPv3 specifications suitable for
> consideration as a Draft Standard. This work will be based upon RFC
> 2251-2256,2829-2831.
>
> The group will deliver an applicability statement defining LDAPv3.
> This work will be based upon draft‑hodges‑ldapv3‑as‑00.txt.

### Goals and Milestones:

> \[The milestone section is out of date.\].

### Internet-Drafts:

> [Lightweight Directory Access Protocol (v3): UTF-8 String
> Representation of Distinguished
> Names](../../../../../../../../internet-drafts/draft-ietf-ldapbis-dn-00.txt)
>
> [Lightweight Directory Access Protocol
> (v3)](../../../../../../../../internet-drafts/draft-ietf-ldapbis-protocol-00.txt)
>
> [Lightweight Directory Access Protocol (v3):Technical
> Specification](../../../../../../../../internet-drafts/draft-ietf-ldapbis-ldapv3-ts-00.txt)
>
> \[There should be a few others, either currently expired or unfinished
> as this date.\]

# LDUP

## Description of the Group

> <http://www.ietf.org/html.charters/ldup-charter.html>
>
> The other successor to the original LDAPv3 group. The group has had
> some very acrimonious meetings in the past. A sharp division exists
> between a distributed directory contingent, who are willing to give up
> perfect consistency between replicated directories in order to gain
> multi-master sources, and a database contingent, who require
> consistency and are less interested in multi-master sources.
>
> This group has an aggressive set of milestones looking towards
> finishing up by the end of 2001. This is rather ambitious but they
> have enough consensus now that they may get some of this finished
> shortly. Replication is dependent on the access control extension in
> LDAPEXT, however.
>
> Replication is a service that almost all LDAP directory
> infrastructures implement (in fact, it's practically a requirement),
> but a standard profile and standard protocols to support it have long
> been lacking. X.500 has a directory shadowing protocol \[DISP\]. As
> LDAP increased its market share (or appeared where no X.500 directory
> had been) the need to develop a standard replication protocol has
> increased. However, the difficulties have been great.
>
> Large scale grids will need replication of parts of their directory
> infrastructure in order to provide a robust infrastructure.
> Replication may also meet some of the information transfer
> requirements involved in creating a virtual organization. The
> discussion and scenarios in the architecture and profile drafts should
> be of interest even if the grid remains a single-vendor directory
> infrastructure.

## Charter

### Description of Working Group: 

> \[Excerpt\] The WG\'s approach is to first develop a set of
> requirements for LDAPv3 directory replication and write an
> applicability statement defining scenarios on which replication
> requirements are based. An engineering team was formed consisting of
> different vendors and the co-chairs in order to harmonize the existing
> approaches into a single standard approach. All of these have been
> accomplished during the pre-working group stage. It should be noted,
> however, that replication using heterogeneous servers is dependent on
> resolving access control issues, which are the domain of other working
> groups.
>
> The new replication architecture support all forms of replication
> mentioned above. Seven areas of working group focus have been
> identified ... \[partly represented below.\]

### Goals and Milestones:

  ------- ---- ------------------------------------------------------------
  Jun 01       LDAPv3 Replication Information Transport Protocol I-D goes
               to WG Last Call as Proposed Standard.

  Jun 01       LDAPv3 Client Update Protocol I-D goes to WG Last Call as
               Proposed Standard

  Aug 01       LDAPv3 Extended Operations for Framing I-D goes to WG Last
               Call as Proposed Standard.

  Dec 01       LDAPv3 Mandatory Replica Management I-D goes to WG Last Call
               as Proposed Standard.

  Dec 01       LDAPv3 Multi-Master Replication Profile I-D goes to WG Last
               Call as Proposed Standard.

  Dec 01       LDAPv3 Master-Slave Replication Profile I-D goes t WG Last
               Call as Proposed Standard.

  Dec 01       Reevaluate Charter and Milestones
  ------- ---- ------------------------------------------------------------

### Internet-Drafts: 

[LDUP Update Reconciliation
Procedures](http://www.ietf.org/internet-drafts/draft-ietf-ldup-urp-04.txt)\
[LDAPv3 Replication
Requirements](http://www.ietf.org/internet-drafts/draft-ietf-ldup-replica-req-09.txt)\
[LDAP Replication
Architecture](http://www.ietf.org/internet-drafts/draft-ietf-ldup-model-06.txt)\
[LDAP Subentry
Schema](http://www.ietf.org/internet-drafts/draft-ietf-ldup-subentry-08.txt)\
[General Usage Profile for LDAPv3
Replication](http://www.ietf.org/internet-drafts/draft-ietf-ldup-usage-profile-00.txt)\
[LDAP Client Update
Protocol](http://www.ietf.org/internet-drafts/draft-ietf-ldup-lcup-00.txt)

# PKIX

## Description of the Group

<http://www.ietf.org/html.charters/pkix-charter.html>

> As this group is developing the core standards for an X.509 PKI for
> the Internet, it is intrinsically linked to Directory. The group is
> working on schema definitions and "profiles" for the use of LDAP as a
> certificate and Certificate Revocation List (CRL) storage mechanism.
> The group is also attempting to produce a certificate validation
> protocol standard. The LDAP profile documents are of interest as a
> possible model for GISWG.

# Other

> Many other IETF groups have worked on directory-like services or
> require LDAP services (like PKIX above). Some have appeared as part of
> the networking group or as open submissions. The TISDAG reports, and
> the [policy
> working](http://www.ietf.org/html.charters/policy-charter.html) group,
> among others, might prove interesting.

# Conclusion

> LDAPEXT offers the most opportunity for Gridforum directory work. It
> experiences problems maintaining momentum and finishing projects under
> some circumstances; the wide variety of projects may make it more
> difficult to focus. A number of these projects (particularly access
> control related drafts) should be of great interest to GISWG. New work
> suggested by problems in Gridforum directory could also find an
> audience at LDAPEXT. It would be useful to find industry allies in
> those cases to help encourage adoption of any new work. LDAPBIS will
> offer a complete and corrected version of the LDAPv3 standard and
> finish the standards process in the near future. For the most part
> this should mean correcting any normative references to earlier LDAP
> RFC's and not affect Grid operations. LDUP despite past divisions is
> focused on finishing up its work, which should lead to an
> interoperable replication standard. That in itself could prove useful
> in creating large scale grids, but the discussion in today's drafts
> and the design of the replication protocol are useful studies for the
> meta-directory problems that are currently being discussed in
> Gridforum.

## Editor\'s Address  {#editors-address .unnumbered}

> Michael Helm
>
> ESnet/LBNL
>
> M/S 50a-3111
>
> Lawrence Berkeley National Laboratory
>
> Berkeley CA 94720
>
> [mailto:helm@fionn.es.net](mailto:helm@fionn.es.net)

## References  {#references .unnumbered}

> \[See internal\]
>
> \[DISP\] X.525: Information technology -- Open Systems Interconnection
> -- The Directory: Replication; ITU-T, 1993‑97
>
> \[X501\] X.501: Information technology -- Open Systems Interconnection
> -- The Directory: Models; ITU-T, 1988‑1997