3.1.1.4.5.3 allowedChildClasses

Let TO be the object from which the allowedChildClasses attribute is being read.

The value of TO!allowedChildClasses is the set of lDAPDisplayName values read from each Object O where:

• (O.distinguishedName is in the schema NC)

• and (O!objectClass is classSchema)

• and (not O!systemOnly)

• and (not O!objectClassCategory is 2)

• and (not O!objectClassCategory is 3)

• and (there exists C in TO!objectClass such that C is in POSSSUPERIORS(O))