Subversion Repositories configs

# OpenLDAP X.509 PMI schema

# $OpenLDAP: pkg/ldap/servers/slapd/schema/pmi.schema,v 1.1.2.3 2010/04/13 20:23:49 kurt Exp $

## This work is part of OpenLDAP Software <http://www.openldap.org/>.

##

## Copyright 1998-2010 The OpenLDAP Foundation.

## All rights reserved.

##

## Redistribution and use in source and binary forms, with or without

## modification, are permitted only as authorized by the OpenLDAP

## Public License.

##

## A copy of this license is available in the file LICENSE in the

## top-level directory of the distribution or, alternatively, at

## <http://www.OpenLDAP.org/license.html>.

#

## Portions Copyright (C) The Internet Society (1997-2006).

## All Rights Reserved.

##

## This document and translations of it may be copied and furnished to

## others, and derivative works that comment on or otherwise explain it

## or assist in its implementation may be prepared, copied, published

## and distributed, in whole or in part, without restriction of any

## kind, provided that the above copyright notice and this paragraph are

## included on all such copies and derivative works.  However, this

## document itself may not be modified in any way, such as by removing

## the copyright notice or references to the Internet Society or other

## Internet organizations, except as needed for the purpose of

## developing Internet standards in which case the procedures for

## copyrights defined in the Internet Standards process must be

## followed, or as required to translate it into languages other than

## English.

##

## The limited permissions granted above are perpetual and will not be

## revoked by the Internet Society or its successors or assigns.

##

## This document and the information contained herein is provided on an

## "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING

## TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING

## BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION

## HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF

## MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

#

#

# Includes LDAPv3 schema items from:

# ITU X.509 (08/2005)

#

## X.509 (08/2005) pp. 120-121

##

## -- object identifier assignments --

## -- object classes --

## id-oc-pmiUser                            OBJECT IDENTIFIER ::= {id-oc 24}

## id-oc-pmiAA                              OBJECT IDENTIFIER ::= {id-oc 25}

## id-oc-pmiSOA                             OBJECT IDENTIFIER ::= {id-oc 26}

## id-oc-attCertCRLDistributionPts          OBJECT IDENTIFIER ::= {id-oc 27}

## id-oc-privilegePolicy                    OBJECT IDENTIFIER ::= {id-oc 32}

## id-oc-pmiDelegationPath                  OBJECT IDENTIFIER ::= {id-oc 33}

## id-oc-protectedPrivilegePolicy           OBJECT IDENTIFIER ::= {id-oc 34}

## -- directory attributes --

## id-at-attributeCertificate               OBJECT IDENTIFIER ::= {id-at 58}

## id-at-attributeCertificateRevocationList OBJECT IDENTIFIER ::= {id-at 59}

## id-at-aACertificate                      OBJECT IDENTIFIER ::= {id-at 61}

## id-at-attributeDescriptorCertificate     OBJECT IDENTIFIER ::= {id-at 62}

## id-at-attributeAuthorityRevocationList   OBJECT IDENTIFIER ::= {id-at 63}

## id-at-privPolicy                         OBJECT IDENTIFIER ::= {id-at 71}

## id-at-role                               OBJECT IDENTIFIER ::= {id-at 72}

## id-at-delegationPath                     OBJECT IDENTIFIER ::= {id-at 73}

## id-at-protPrivPolicy                     OBJECT IDENTIFIER ::= {id-at 74}

## id-at-xMLPrivilegeInfo                   OBJECT IDENTIFIER ::= {id-at 75}

## id-at-xMLPprotPrivPolicy                 OBJECT IDENTIFIER ::= {id-at 76}

## -- attribute certificate extensions --

## id-ce-authorityAttributeIdentifier       OBJECT IDENTIFIER ::= {id-ce 38}

## id-ce-roleSpecCertIdentifier             OBJECT IDENTIFIER ::= {id-ce 39}

## id-ce-basicAttConstraints                OBJECT IDENTIFIER ::= {id-ce 41}

## id-ce-delegatedNameConstraints           OBJECT IDENTIFIER ::= {id-ce 42}

## id-ce-timeSpecification                  OBJECT IDENTIFIER ::= {id-ce 43}

## id-ce-attributeDescriptor                OBJECT IDENTIFIER ::= {id-ce 48}

## id-ce-userNotice                         OBJECT IDENTIFIER ::= {id-ce 49}

## id-ce-sOAIdentifier                      OBJECT IDENTIFIER ::= {id-ce 50}

## id-ce-acceptableCertPolicies             OBJECT IDENTIFIER ::= {id-ce 52}

## id-ce-targetInformation                  OBJECT IDENTIFIER ::= {id-ce 55}

## id-ce-noRevAvail                         OBJECT IDENTIFIER ::= {id-ce 56}

## id-ce-acceptablePrivilegePolicies        OBJECT IDENTIFIER ::= {id-ce 57}

## id-ce-indirectIssuer                     OBJECT IDENTIFIER ::= {id-ce 61}

## id-ce-noAssertion                        OBJECT IDENTIFIER ::= {id-ce 62}

## id-ce-issuedOnBehalfOf                   OBJECT IDENTIFIER ::= {id-ce 64}

## -- PMI matching rules --

## id-mr-attributeCertificateMatch          OBJECT IDENTIFIER ::= {id-mr 42}

## id-mr-attributeCertificateExactMatch     OBJECT IDENTIFIER ::= {id-mr 45}

## id-mr-holderIssuerMatch                  OBJECT IDENTIFIER ::= {id-mr 46}

## id-mr-authAttIdMatch                     OBJECT IDENTIFIER ::= {id-mr 53}

## id-mr-roleSpecCertIdMatch                OBJECT IDENTIFIER ::= {id-mr 54}

## id-mr-basicAttConstraintsMatch           OBJECT IDENTIFIER ::= {id-mr 55}

## id-mr-delegatedNameConstraintsMatch      OBJECT IDENTIFIER ::= {id-mr 56}

## id-mr-timeSpecMatch                      OBJECT IDENTIFIER ::= {id-mr 57}

## id-mr-attDescriptorMatch                 OBJECT IDENTIFIER ::= {id-mr 58}

## id-mr-acceptableCertPoliciesMatch        OBJECT IDENTIFIER ::= {id-mr 59}

## id-mr-delegationPathMatch                OBJECT IDENTIFIER ::= {id-mr 61}

## id-mr-sOAIdentifierMatch                 OBJECT IDENTIFIER ::= {id-mr 66}

## id-mr-indirectIssuerMatch                OBJECT IDENTIFIER ::= {id-mr 67}

##

##

## X.509 (08/2005) pp. 71, 86-89

##

## 14.4.1 Role attribute

## role  ATTRIBUTE ::= {

##       WITH SYNTAX         RoleSyntax

##       ID                  id-at-role }

## RoleSyntax ::= SEQUENCE {

## roleAuthority     [0]     GeneralNames  OPTIONAL,

## roleName          [1]     GeneralName }

##

## 14.5     XML privilege information attribute

##    xmlPrivilegeInfo ATTRIBUTE ::= {

##      WITH SYNTAX UTF8String -- contains XML-encoded privilege information

##      ID                 id-at-xMLPrivilegeInfo }

##

## 17.1 PMI directory object classes

##

## 17.1.1   PMI user object class

##    pmiUser OBJECT-CLASS ::= {

##    -- a PMI user (i.e., a "holder")

##      SUBCLASS OF          {top}

##      KIND                 auxiliary

##      MAY CONTAIN          {attributeCertificateAttribute}

##      ID                   id-oc-pmiUser }

##

## 17.1.2     PMI AA object class

##     pmiAA OBJECT-CLASS ::= {

##     -- a PMI AA

##       SUBCLASS OF          {top}

##       KIND                 auxiliary

##       MAY CONTAIN          {aACertificate |

##                            attributeCertificateRevocationList |

##                            attributeAuthorityRevocationList}

##       ID                   id-oc-pmiAA }

##

## 17.1.3     PMI SOA object class

##     pmiSOA OBJECT-CLASS ::= { -- a PMI Source of Authority

##       SUBCLASS OF {top}

##       KIND                 auxiliary

##       MAY CONTAIN          {attributeCertificateRevocationList |

##                            attributeAuthorityRevocationList |

##                            attributeDescriptorCertificate}

##       ID                   id-oc-pmiSOA }

##

## 17.1.4     Attribute certificate CRL distribution point object class

##     attCertCRLDistributionPt          OBJECT-CLASS ::= {

##       SUBCLASS OF {top}

##       KIND                 auxiliary

##       MAY CONTAIN          { attributeCertificateRevocationList |

##                            attributeAuthorityRevocationList }

##       ID                   id-oc-attCertCRLDistributionPts }

##

## 17.1.5     PMI delegation path

##     pmiDelegationPath            OBJECT-CLASS ::= {

##         SUBCLASS OF              {top}

##         KIND                     auxiliary

##         MAY CONTAIN              { delegationPath }

##         ID                       id-oc-pmiDelegationPath }

##

## 17.1.6     Privilege policy object class

##     privilegePolicy        OBJECT-CLASS ::= {

##         SUBCLASS OF              {top}

##         KIND                     auxiliary

##         MAY CONTAIN              {privPolicy }

##         ID                       id-oc-privilegePolicy }

##

## 17.1.7     Protected privilege policy object class

##     protectedPrivilegePolicy               OBJECT-CLASS       ::= {

##         SUBCLASS OF              {top}

##         KIND                     auxiliary

##         MAY CONTAIN            {protPrivPolicy }

##         ID                     id-oc-protectedPrivilegePolicy }

##

## 17.2       PMI Directory attributes

##

## 17.2.1     Attribute certificate attribute

##     attributeCertificateAttribute ATTRIBUTE ::= {

##         WITH SYNTAX                            AttributeCertificate

##         EQUALITY MATCHING RULE                 attributeCertificateExactMatch

##         ID                                     id-at-attributeCertificate }

##

## 17.2.2     AA certificate attribute

##     aACertificate         ATTRIBUTE ::= {

##         WITH SYNTAX                            AttributeCertificate

##         EQUALITY MATCHING RULE                 attributeCertificateExactMatch

##         ID                                     id-at-aACertificate }

##

## 17.2.3     Attribute descriptor certificate attribute

##     attributeDescriptorCertificate        ATTRIBUTE ::= {

##         WITH SYNTAX                            AttributeCertificate

##         EQUALITY MATCHING RULE                 attributeCertificateExactMatch

##         ID                                     id-at-attributeDescriptorCertificate }

##

## 17.2.4     Attribute certificate revocation list attribute

##     attributeCertificateRevocationList         ATTRIBUTE ::= {

##         WITH SYNTAX                            CertificateList

##         EQUALITY MATCHING RULE                 certificateListExactMatch

##         ID                                     id-at-attributeCertificateRevocationList}

##

## 17.2.5     AA certificate revocation list attribute

##     attributeAuthorityRevocationList           ATTRIBUTE ::= {

##         WITH SYNTAX                            CertificateList

##         EQUALITY MATCHING RULE                 certificateListExactMatch

##         ID                                     id-at-attributeAuthorityRevocationList }

##

## 17.2.6     Delegation path attribute

##     delegationPath        ATTRIBUTE ::= {

##         WITH SYNTAX                  AttCertPath

##         ID                           id-at-delegationPath }

##     AttCertPath      ::= SEQUENCE OF AttributeCertificate

##

## 17.2.7     Privilege policy attribute

##     privPolicy ATTRIBUTE ::= {

##         WITH SYNTAX             PolicySyntax

##         ID                      id-at-privPolicy }

##

## 17.2.8     Protected privilege policy attribute

##        protPrivPolicy       ATTRIBUTE        ::= {

##         WITH SYNTAX                          AttributeCertificate

##         EQUALITY MATCHING RULE               attributeCertificateExactMatch

##         ID                                   id-at-protPrivPolicy }

##

## 17.2.9     XML Protected privilege policy attribute

##        xmlPrivPolicy        ATTRIBUTE ::= {

##         WITH SYNTAX         UTF8String -- contains XML-encoded privilege policy information

##         ID                  id-at-xMLPprotPrivPolicy }

##

## -- object identifier assignments --

## -- object classes --

objectidentifier	id-oc-pmiUser 2.5.6.24

objectidentifier	id-oc-pmiAA 2.5.6.25

objectidentifier	id-oc-pmiSOA 2.5.6.26

objectidentifier	id-oc-attCertCRLDistributionPts 2.5.6.27

objectidentifier	id-oc-privilegePolicy 2.5.6.32

objectidentifier	id-oc-pmiDelegationPath 2.5.6.33

objectidentifier	id-oc-protectedPrivilegePolicy 2.5.6.34

## -- directory attributes --

objectidentifier	id-at-attributeCertificate 2.5.4.58

objectidentifier	id-at-attributeCertificateRevocationList 2.5.4.59

objectidentifier	id-at-aACertificate 2.5.4.61

objectidentifier	id-at-attributeDescriptorCertificate 2.5.4.62

objectidentifier	id-at-attributeAuthorityRevocationList 2.5.4.63

objectidentifier	id-at-privPolicy 2.5.4.71

objectidentifier	id-at-role 2.5.4.72

objectidentifier	id-at-delegationPath 2.5.4.73

objectidentifier	id-at-protPrivPolicy 2.5.4.74

objectidentifier	id-at-xMLPrivilegeInfo 2.5.4.75

objectidentifier	id-at-xMLPprotPrivPolicy 2.5.4.76

## -- attribute certificate extensions --

## id-ce-authorityAttributeIdentifier       OBJECT IDENTIFIER ::= {id-ce 38}

## id-ce-roleSpecCertIdentifier             OBJECT IDENTIFIER ::= {id-ce 39}

## id-ce-basicAttConstraints                OBJECT IDENTIFIER ::= {id-ce 41}

## id-ce-delegatedNameConstraints           OBJECT IDENTIFIER ::= {id-ce 42}

## id-ce-timeSpecification                  OBJECT IDENTIFIER ::= {id-ce 43}

## id-ce-attributeDescriptor                OBJECT IDENTIFIER ::= {id-ce 48}

## id-ce-userNotice                         OBJECT IDENTIFIER ::= {id-ce 49}

## id-ce-sOAIdentifier                      OBJECT IDENTIFIER ::= {id-ce 50}

## id-ce-acceptableCertPolicies             OBJECT IDENTIFIER ::= {id-ce 52}

## id-ce-targetInformation                  OBJECT IDENTIFIER ::= {id-ce 55}

## id-ce-noRevAvail                         OBJECT IDENTIFIER ::= {id-ce 56}

## id-ce-acceptablePrivilegePolicies        OBJECT IDENTIFIER ::= {id-ce 57}

## id-ce-indirectIssuer                     OBJECT IDENTIFIER ::= {id-ce 61}

## id-ce-noAssertion                        OBJECT IDENTIFIER ::= {id-ce 62}

## id-ce-issuedOnBehalfOf                   OBJECT IDENTIFIER ::= {id-ce 64}

## -- PMI matching rules --

objectidentifier	id-mr 2.5.13

objectidentifier	id-mr-attributeCertificateMatch id-mr:42

objectidentifier	id-mr-attributeCertificateExactMatch id-mr:45

objectidentifier	id-mr-holderIssuerMatch id-mr:46

objectidentifier	id-mr-authAttIdMatch id-mr:53

objectidentifier	id-mr-roleSpecCertIdMatch id-mr:54

objectidentifier	id-mr-basicAttConstraintsMatch id-mr:55

objectidentifier	id-mr-delegatedNameConstraintsMatch id-mr:56

objectidentifier	id-mr-timeSpecMatch id-mr:57

objectidentifier	id-mr-attDescriptorMatch id-mr:58

objectidentifier	id-mr-acceptableCertPoliciesMatch id-mr:59

objectidentifier	id-mr-delegationPathMatch id-mr:61

objectidentifier	id-mr-sOAIdentifierMatch id-mr:66

objectidentifier	id-mr-indirectIssuerMatch id-mr:67

## -- syntaxes --

## NOTE: 1.3.6.1.4.1.4203.666.11.10 is the oid arc assigned by OpenLDAP

## to this work in progress

objectidentifier	AttributeCertificate 1.3.6.1.4.1.4203.666.11.10.2.1

objectidentifier	CertificateList 1.3.6.1.4.1.1466.115.121.1.9

objectidentifier	AttCertPath 1.3.6.1.4.1.4203.666.11.10.2.4

objectidentifier	PolicySyntax 1.3.6.1.4.1.4203.666.11.10.2.5

objectidentifier	RoleSyntax 1.3.6.1.4.1.4203.666.11.10.2.6

#  NOTE: OIDs from <draft-ietf-pkix-ldap-schema-02.txt> (expired)

#objectidentifier	AttributeCertificate 1.2.826.0.1.3344810.7.5

#objectidentifier	AttCertPath 1.2.826.0.1.3344810.7.10

#objectidentifier	PolicySyntax 1.2.826.0.1.3344810.7.17

#objectidentifier	RoleSyntax 1.2.826.0.1.3344810.7.13

##

## Substitute syntaxes

##

## AttCertPath

ldapsyntax ( 1.3.6.1.4.1.4203.666.11.10.2.4

	NAME 'AttCertPath'

	DESC 'X.509 PMI attribute cartificate path: SEQUENCE OF AttributeCertificate'

	X-SUBST '1.3.6.1.4.1.1466.115.121.1.15' )

##

## PolicySyntax

ldapsyntax ( 1.3.6.1.4.1.4203.666.11.10.2.5

	NAME 'PolicySyntax'

	DESC 'X.509 PMI policy syntax'

	X-SUBST '1.3.6.1.4.1.1466.115.121.1.15' )

##

## RoleSyntax

ldapsyntax ( 1.3.6.1.4.1.4203.666.11.10.2.6

	NAME 'RoleSyntax'

	DESC 'X.509 PMI role syntax'

	X-SUBST '1.3.6.1.4.1.1466.115.121.1.15' )

##

## X.509 (08/2005) pp. 71, 86-89

##

## 14.4.1 Role attribute

attributeType ( id-at-role

	NAME 'role'

	DESC 'X.509 Role attribute, use ;binary'

	SYNTAX RoleSyntax )

##

## 14.5     XML privilege information attribute

##  -- contains XML-encoded privilege information

attributeType ( id-at-xMLPrivilegeInfo

	NAME 'xmlPrivilegeInfo'

	DESC 'X.509 XML privilege information attribute'

	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )

##

## 17.2       PMI Directory attributes

##

## 17.2.1     Attribute certificate attribute

attributeType ( id-at-attributeCertificate

	NAME 'attributeCertificateAttribute'

	DESC 'X.509 Attribute certificate attribute, use ;binary'

	SYNTAX AttributeCertificate

	EQUALITY attributeCertificateExactMatch )

##

## 17.2.2     AA certificate attribute

attributeType ( id-at-aACertificate

	NAME 'aACertificate'

	DESC 'X.509 AA certificate attribute, use ;binary'

	SYNTAX AttributeCertificate

	EQUALITY attributeCertificateExactMatch )

##

## 17.2.3     Attribute descriptor certificate attribute

attributeType ( id-at-attributeDescriptorCertificate

	NAME 'attributeDescriptorCertificate'

	DESC 'X.509 Attribute descriptor certificate attribute, use ;binary'

	SYNTAX AttributeCertificate

	EQUALITY attributeCertificateExactMatch )

##

## 17.2.4     Attribute certificate revocation list attribute

attributeType ( id-at-attributeCertificateRevocationList

	NAME 'attributeCertificateRevocationList'

	DESC 'X.509 Attribute certificate revocation list attribute, use ;binary'

	SYNTAX CertificateList

	X-EQUALITY 'certificateListExactMatch, not implemented yet' )

##

## 17.2.5     AA certificate revocation list attribute

attributeType ( id-at-attributeAuthorityRevocationList

	NAME 'attributeAuthorityRevocationList'

	DESC 'X.509 AA certificate revocation list attribute, use ;binary'

	SYNTAX CertificateList

	X-EQUALITY 'certificateListExactMatch, not implemented yet' )

##

## 17.2.6     Delegation path attribute

attributeType ( id-at-delegationPath

	NAME 'delegationPath'

	DESC 'X.509 Delegation path attribute, use ;binary'

	SYNTAX AttCertPath )

##     AttCertPath      ::= SEQUENCE OF AttributeCertificate

##

## 17.2.7     Privilege policy attribute

attributeType ( id-at-privPolicy

	NAME 'privPolicy'

	DESC 'X.509 Privilege policy attribute, use ;binary'

	SYNTAX PolicySyntax )

##

## 17.2.8     Protected privilege policy attribute

attributeType ( id-at-protPrivPolicy

	NAME 'protPrivPolicy'

	DESC 'X.509 Protected privilege policy attribute, use ;binary'

	SYNTAX AttributeCertificate

	EQUALITY attributeCertificateExactMatch )

##

## 17.2.9     XML Protected privilege policy attribute

## -- contains XML-encoded privilege policy information

attributeType ( id-at-xMLPprotPrivPolicy

	NAME 'xmlPrivPolicy'

	DESC 'X.509 XML Protected privilege policy attribute'

	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )

##

## 17.1 PMI directory object classes

##

## 17.1.1   PMI user object class

##    -- a PMI user (i.e., a "holder")

objectClass ( id-oc-pmiUser

	NAME 'pmiUser'

	DESC 'X.509 PMI user object class'

	SUP top

	AUXILIARY

	MAY ( attributeCertificateAttribute ) )

##

## 17.1.2     PMI AA object class

##     -- a PMI AA

objectClass ( id-oc-pmiAA

	NAME 'pmiAA'

	DESC 'X.509 PMI AA object class'

	SUP top

	AUXILIARY

	MAY ( aACertificate $

		attributeCertificateRevocationList $

		attributeAuthorityRevocationList

	) )

##

## 17.1.3     PMI SOA object class

##     -- a PMI Source of Authority

objectClass ( id-oc-pmiSOA

	NAME 'pmiSOA'

	DESC 'X.509 PMI SOA object class'

	SUP top

	AUXILIARY

	MAY ( attributeCertificateRevocationList $

		attributeAuthorityRevocationList $

		attributeDescriptorCertificate

	) )

##

## 17.1.4     Attribute certificate CRL distribution point object class

objectClass ( id-oc-attCertCRLDistributionPts

	NAME 'attCertCRLDistributionPt'

	DESC 'X.509 Attribute certificate CRL distribution point object class'

	SUP top

	AUXILIARY

	MAY ( attributeCertificateRevocationList $

		attributeAuthorityRevocationList

	) )

##

## 17.1.5     PMI delegation path

objectClass ( id-oc-pmiDelegationPath

	NAME 'pmiDelegationPath'

	DESC 'X.509 PMI delegation path'

	SUP top

	AUXILIARY

	MAY ( delegationPath ) )

##

## 17.1.6     Privilege policy object class

objectClass ( id-oc-privilegePolicy

	NAME 'privilegePolicy'

	DESC 'X.509 Privilege policy object class'

	SUP top

	AUXILIARY

	MAY ( privPolicy ) )

##

## 17.1.7     Protected privilege policy object class

objectClass ( id-oc-protectedPrivilegePolicy

	NAME 'protectedPrivilegePolicy'

	DESC 'X.509 Protected privilege policy object class'

	SUP top

	AUXILIARY

	MAY ( protPrivPolicy ) )