x-eduPerson Object Class Specification (201206)

Status of this document

The x-eduPerson (201206) object class specification is described in this document. This version is intended to support experimentals trials of proposed new attributes. The x-eduPerson object class is a way to segregate those attributes from eduPerson proper until such time as experience and community consensus suggest moving a particular experimental attribute into eduPerson proper. Note that the attribute definitions, up to and including the official attribute OID, remain the same whether the containing object class is x-eduPerson or eduPerson itself.

0. Table of Contents

1 x-eduPerson Object Class and Attributes

1.1 x-eduPerson Object Class Definition

All Both eduPerson- and x-eduPerson-defined attribute names are prefaced with "eduPerson." The x-eduPerson auxiliary object class contains all experimental or trial attributes as "MAY" attributes:

( 1.3.6.1.4.1.5923.1.1.3

        NAME 'x-eduPerson'

        AUXILIARY

        MAY ( eduPersonPrincipalNamePrior )

)

1.2 x-eduPerson Attribute Definitions

Attributes in the following section were newly defined for x-eduPerson. Each entry specifies the version of x-eduPerson in which the attribute was first defined.

1.2.1. eduPersonPrincipalNamePrior (defined in x-eduPerson (201206) ); OID: 1.3.6.1.4.1.5923.1.1.1.12

( 1.3.6.1.4.1.5923.1.1.1.1

          NAME 'eduPersonPrincipalNamePrior'

          DESC 'eduPersonPrincipalNamePrior per Internet2'

          EQUALITY caseIgnoreMatch

          SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )

Application utility class: standard; # of values: multi

Definition

Older scoped identifiers for a person. A historical counterpart to the eduPersonPrincipalName attribute, each value of this multi-valued attribute represents an ePPN value that was previously associated with the entry. The values MUST NOT include the currently valid ePPN value. There is no implied or assumed order to the values. This attribute MUST NOT be populated if ePPN values are ever reassigned to a different entry (after, for example, a period of dormancy). That is, they MUST be unique in space and over time.

Notes This attribute provides a historical record of ePPN values associated with an entry, provided the values are not subject to reassignment. It is permissible to reassign ePPN values, but doing so precludes the use of this attribute; consumers must be able to assume that a historical ePPN value is associated with exactly one entry for all time. As an identifier that may be based on a user's name, values of ePPN may change over time, and this creates problems for applications that are limited in their capacity to accommodate less friendly identifiers. To improve the user experience in such cases, applications may be enhanced to leverage this attribute to identify renamed accounts. Applications that support automated renaming can be enhanced to do so, while those that do not could be enhanced with logging or exception reporting that identifies the problem. It is strongly preferable to enhance, or build new, applications to support more stable/persistent (and necessarily opaque) identifiers, but this attribute may be useful as a transitional aid. It is permissible, though likely unusual, for a subject with no current eduPersonPrincipalName value to have eduPersonPrincipalNamePrior values. This could reflect, for example, a deprovisioning scenario.

Example (LDIF Fragment)

eduPersonPrincipalName: baz@hsww.wiz
eduPersonPrincipalNamePrior: foo@hsww.wiz
eduPersonPrincipalNamePrior: bar@hsww.wiz

Syntax: directoryString;

Indexing: pres,eq,sub

This section lists changes that have been made from version to version of x-eduPerson.

Since x-eduPerson (201206) is the first release, this section is empty.

MACE-Dir members and others who contributed to the definition of this object class include Scott Cantor, David Bantz, Michael Gettes, Michael Grady, Keith Hazelton, Michael Hodges, Mark Jones, Michael Pelikan, Mark Rank and others.