version: "0.1"
description: >
  Canonical LDAP Schema for KeyCape / NetKingdom IAM Profile.
  Expresses the canonical identity model in LDAP terms.
  Portable across LLDAP, OpenLDAP, 389DS, and Active Directory.

base_dn: "dc=netkingdom,dc=local"

organization_units:
  users:
    dn: "ou=users,dc=netkingdom,dc=local"
    description: "User accounts"
    object_classes:
      required:
        - inetOrgPerson
        - organizationalPerson
        - person
        - top
    attributes:
      required:
        - uid    # canonical: username
        - cn     # canonical: displayName
        - sn     # canonical: surname (may be set to displayName if absent)
      optional:
        - mail       # canonical: email
        - memberOf   # back-reference to group membership
      forbidden: []
    naming_attr: uid
    examples:
      - dn: "uid=alice,ou=users,dc=netkingdom,dc=local"
        uid: alice
        cn: "Alice Example"
        sn: Example
        mail: alice@example.com

  groups:
    dn: "ou=groups,dc=netkingdom,dc=local"
    description: "User groups"
    object_classes:
      required:
        - groupOfNames
        - top
    attributes:
      required:
        - cn      # canonical: name
        - member  # list of member DNs
      optional:
        - description
      forbidden: []
    naming_attr: cn
    examples:
      - dn: "cn=admins,ou=groups,dc=netkingdom,dc=local"
        cn: admins
        member:
          - "uid=alice,ou=users,dc=netkingdom,dc=local"

  clients:
    dn: "ou=clients,dc=netkingdom,dc=local"
    description: "OIDC client registrations"
    object_classes:
      required:
        - inetOrgPerson
        - top
    attributes:
      required:
        - uid  # canonical: clientId
        - cn   # canonical: displayName
      optional:
        - description
      forbidden: []
    naming_attr: uid

validation_rules:
  structural:
    - name: valid_dn_structure
      description: "All DNs must conform to the base_dn and OU layout above."
    - name: required_attributes_present
      description: "Every entry must carry all required attributes for its OU."
    - name: raw_attributes_well_formed
      description: >
        Raw ldapAttributes keys must be valid LDAP attribute descriptors, must
        not shadow an attribute the canonical model owns (uid, cn, mail), and
        must not repeat one attribute under different casing. This is not an
        allow-list: ldapAttributes carries what the canonical model does not
        name, so no permitted-name set can be derived from the schema.
    - name: valid_group_memberships
      description: "All member values must be non-empty valid DNs."
  semantic:
    - name: referenced_users_exist
      description: "Every user ID referenced in group members must exist."
    - name: no_cyclic_groups
      description: "Groups may not contain other group IDs as members."
    - name: usernames_unique
      description: "The uid attribute must be unique across ou=users."
    - name: email_format_valid
      description: "mail, when present, must be a valid RFC 5322 address."