WebSVN – configs – /homeserver/etc/openldap/schema/pmi.schema

# OpenLDAP X.509 PMI schema
# $OpenLDAP$
## This work is part of OpenLDAP Software <http://www.openldap.org/>.
##
## Copyright 1998-2014 The OpenLDAP Foundation.
## All rights reserved.
##
## Redistribution and use in source and binary forms, with or without
## modification, are permitted only as authorized by the OpenLDAP
## Public License.
##
## A copy of this license is available in the file LICENSE in the
## top-level directory of the distribution or, alternatively, at
## <http://www.OpenLDAP.org/license.html>.
#
## Portions Copyright (C) The Internet Society (1997-2006).
## All Rights Reserved.
##
## This document and translations of it may be copied and furnished to
## others, and derivative works that comment on or otherwise explain it
## or assist in its implementation may be prepared, copied, published
## and distributed, in whole or in part, without restriction of any
## kind, provided that the above copyright notice and this paragraph are
## included on all such copies and derivative works.  However, this
## document itself may not be modified in any way, such as by removing
## the copyright notice or references to the Internet Society or other
## Internet organizations, except as needed for the purpose of
## developing Internet standards in which case the procedures for
## copyrights defined in the Internet Standards process must be         
## followed, or as required to translate it into languages other than
## English.
##                                                                      
## The limited permissions granted above are perpetual and will not be  
## revoked by the Internet Society or its successors or assigns.        
## 
## This document and the information contained herein is provided on an 
## "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
## TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
## BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
## HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
## MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

#
#
# Includes LDAPv3 schema items from:
# ITU X.509 (08/2005)
#
## X.509 (08/2005) pp. 120-121
## 
## -- object identifier assignments --
## -- object classes --
## id-oc-pmiUser                            OBJECT IDENTIFIER ::= {id-oc 24}
## id-oc-pmiAA                              OBJECT IDENTIFIER ::= {id-oc 25}
## id-oc-pmiSOA                             OBJECT IDENTIFIER ::= {id-oc 26}
## id-oc-attCertCRLDistributionPts          OBJECT IDENTIFIER ::= {id-oc 27}
## id-oc-privilegePolicy                    OBJECT IDENTIFIER ::= {id-oc 32}
## id-oc-pmiDelegationPath                  OBJECT IDENTIFIER ::= {id-oc 33}
## id-oc-protectedPrivilegePolicy           OBJECT IDENTIFIER ::= {id-oc 34}
## -- directory attributes --
## id-at-attributeCertificate               OBJECT IDENTIFIER ::= {id-at 58}
## id-at-attributeCertificateRevocationList OBJECT IDENTIFIER ::= {id-at 59}
## id-at-aACertificate                      OBJECT IDENTIFIER ::= {id-at 61}
## id-at-attributeDescriptorCertificate     OBJECT IDENTIFIER ::= {id-at 62}
## id-at-attributeAuthorityRevocationList   OBJECT IDENTIFIER ::= {id-at 63}
## id-at-privPolicy                         OBJECT IDENTIFIER ::= {id-at 71}
## id-at-role                               OBJECT IDENTIFIER ::= {id-at 72}
## id-at-delegationPath                     OBJECT IDENTIFIER ::= {id-at 73}
## id-at-protPrivPolicy                     OBJECT IDENTIFIER ::= {id-at 74}
## id-at-xMLPrivilegeInfo                   OBJECT IDENTIFIER ::= {id-at 75}
## id-at-xMLPprotPrivPolicy                 OBJECT IDENTIFIER ::= {id-at 76}
## -- attribute certificate extensions --
## id-ce-authorityAttributeIdentifier       OBJECT IDENTIFIER ::= {id-ce 38}
## id-ce-roleSpecCertIdentifier             OBJECT IDENTIFIER ::= {id-ce 39}
## id-ce-basicAttConstraints                OBJECT IDENTIFIER ::= {id-ce 41}
## id-ce-delegatedNameConstraints           OBJECT IDENTIFIER ::= {id-ce 42}
## id-ce-timeSpecification                  OBJECT IDENTIFIER ::= {id-ce 43}
## id-ce-attributeDescriptor                OBJECT IDENTIFIER ::= {id-ce 48}
## id-ce-userNotice                         OBJECT IDENTIFIER ::= {id-ce 49}
## id-ce-sOAIdentifier                      OBJECT IDENTIFIER ::= {id-ce 50}
## id-ce-acceptableCertPolicies             OBJECT IDENTIFIER ::= {id-ce 52}
## id-ce-targetInformation                  OBJECT IDENTIFIER ::= {id-ce 55}
## id-ce-noRevAvail                         OBJECT IDENTIFIER ::= {id-ce 56}
## id-ce-acceptablePrivilegePolicies        OBJECT IDENTIFIER ::= {id-ce 57}
## id-ce-indirectIssuer                     OBJECT IDENTIFIER ::= {id-ce 61}
## id-ce-noAssertion                        OBJECT IDENTIFIER ::= {id-ce 62}
## id-ce-issuedOnBehalfOf                   OBJECT IDENTIFIER ::= {id-ce 64}
## -- PMI matching rules --
## id-mr-attributeCertificateMatch          OBJECT IDENTIFIER ::= {id-mr 42}
## id-mr-attributeCertificateExactMatch     OBJECT IDENTIFIER ::= {id-mr 45}
## id-mr-holderIssuerMatch                  OBJECT IDENTIFIER ::= {id-mr 46}
## id-mr-authAttIdMatch                     OBJECT IDENTIFIER ::= {id-mr 53}
## id-mr-roleSpecCertIdMatch                OBJECT IDENTIFIER ::= {id-mr 54}
## id-mr-basicAttConstraintsMatch           OBJECT IDENTIFIER ::= {id-mr 55}
## id-mr-delegatedNameConstraintsMatch      OBJECT IDENTIFIER ::= {id-mr 56}
## id-mr-timeSpecMatch                      OBJECT IDENTIFIER ::= {id-mr 57}
## id-mr-attDescriptorMatch                 OBJECT IDENTIFIER ::= {id-mr 58}
## id-mr-acceptableCertPoliciesMatch        OBJECT IDENTIFIER ::= {id-mr 59}
## id-mr-delegationPathMatch                OBJECT IDENTIFIER ::= {id-mr 61}
## id-mr-sOAIdentifierMatch                 OBJECT IDENTIFIER ::= {id-mr 66}
## id-mr-indirectIssuerMatch                OBJECT IDENTIFIER ::= {id-mr 67}
## 
## 
## X.509 (08/2005) pp. 71, 86-89
##
## 14.4.1 Role attribute
## role  ATTRIBUTE ::= {
##       WITH SYNTAX         RoleSyntax
##       ID                  id-at-role }
## RoleSyntax ::= SEQUENCE {
## roleAuthority     [0]     GeneralNames  OPTIONAL,
## roleName          [1]     GeneralName }
## 
## 14.5     XML privilege information attribute
##    xmlPrivilegeInfo ATTRIBUTE ::= {
##      WITH SYNTAX UTF8String -- contains XML-encoded privilege information
##      ID                 id-at-xMLPrivilegeInfo }
## 
## 17.1 PMI directory object classes
## 
## 17.1.1   PMI user object class
##    pmiUser OBJECT-CLASS ::= {
##    -- a PMI user (i.e., a "holder")
##      SUBCLASS OF          {top}
##      KIND                 auxiliary
##      MAY CONTAIN          {attributeCertificateAttribute}
##      ID                   id-oc-pmiUser }
## 
## 17.1.2     PMI AA object class
##     pmiAA OBJECT-CLASS ::= {
##     -- a PMI AA
##       SUBCLASS OF          {top}
##       KIND                 auxiliary
##       MAY CONTAIN          {aACertificate |
##                            attributeCertificateRevocationList |
##                            attributeAuthorityRevocationList}
##       ID                   id-oc-pmiAA }
## 
## 17.1.3     PMI SOA object class
##     pmiSOA OBJECT-CLASS ::= { -- a PMI Source of Authority
##       SUBCLASS OF {top}
##       KIND                 auxiliary
##       MAY CONTAIN          {attributeCertificateRevocationList |
##                            attributeAuthorityRevocationList |
##                            attributeDescriptorCertificate}
##       ID                   id-oc-pmiSOA }
## 
## 17.1.4     Attribute certificate CRL distribution point object class
##     attCertCRLDistributionPt          OBJECT-CLASS ::= {
##       SUBCLASS OF {top}
##       KIND                 auxiliary
##       MAY CONTAIN          { attributeCertificateRevocationList |
##                            attributeAuthorityRevocationList }
##       ID                   id-oc-attCertCRLDistributionPts }
## 
## 17.1.5     PMI delegation path
##     pmiDelegationPath            OBJECT-CLASS ::= {
##         SUBCLASS OF              {top}
##         KIND                     auxiliary
##         MAY CONTAIN              { delegationPath }
##         ID                       id-oc-pmiDelegationPath }
## 
## 17.1.6     Privilege policy object class
##     privilegePolicy        OBJECT-CLASS ::= {
##         SUBCLASS OF              {top}
##         KIND                     auxiliary
##         MAY CONTAIN              {privPolicy }
##         ID                       id-oc-privilegePolicy }
## 
## 17.1.7     Protected privilege policy object class
##     protectedPrivilegePolicy               OBJECT-CLASS       ::= {
##         SUBCLASS OF              {top}
##         KIND                     auxiliary
##         MAY CONTAIN            {protPrivPolicy }
##         ID                     id-oc-protectedPrivilegePolicy }
## 
## 17.2       PMI Directory attributes
## 
## 17.2.1     Attribute certificate attribute
##     attributeCertificateAttribute ATTRIBUTE ::= {
##         WITH SYNTAX                            AttributeCertificate
##         EQUALITY MATCHING RULE                 attributeCertificateExactMatch
##         ID                                     id-at-attributeCertificate }
## 
## 17.2.2     AA certificate attribute
##     aACertificate         ATTRIBUTE ::= {
##         WITH SYNTAX                            AttributeCertificate
##         EQUALITY MATCHING RULE                 attributeCertificateExactMatch
##         ID                                     id-at-aACertificate }
## 
## 17.2.3     Attribute descriptor certificate attribute
##     attributeDescriptorCertificate        ATTRIBUTE ::= {
##         WITH SYNTAX                            AttributeCertificate
##         EQUALITY MATCHING RULE                 attributeCertificateExactMatch
##         ID                                     id-at-attributeDescriptorCertificate }
## 
## 17.2.4     Attribute certificate revocation list attribute
##     attributeCertificateRevocationList         ATTRIBUTE ::= {
##         WITH SYNTAX                            CertificateList
##         EQUALITY MATCHING RULE                 certificateListExactMatch
##         ID                                     id-at-attributeCertificateRevocationList}
## 
## 17.2.5     AA certificate revocation list attribute
##     attributeAuthorityRevocationList           ATTRIBUTE ::= {
##         WITH SYNTAX                            CertificateList
##         EQUALITY MATCHING RULE                 certificateListExactMatch
##         ID                                     id-at-attributeAuthorityRevocationList }
## 
## 17.2.6     Delegation path attribute
##     delegationPath        ATTRIBUTE ::= {
##         WITH SYNTAX                  AttCertPath
##         ID                           id-at-delegationPath }
##     AttCertPath      ::= SEQUENCE OF AttributeCertificate
## 
## 17.2.7     Privilege policy attribute
##     privPolicy ATTRIBUTE ::= {
##         WITH SYNTAX             PolicySyntax
##         ID                      id-at-privPolicy }
## 
## 17.2.8     Protected privilege policy attribute
##        protPrivPolicy       ATTRIBUTE        ::= {
##         WITH SYNTAX                          AttributeCertificate
##         EQUALITY MATCHING RULE               attributeCertificateExactMatch
##         ID                                   id-at-protPrivPolicy }
## 
## 17.2.9     XML Protected privilege policy attribute
##        xmlPrivPolicy        ATTRIBUTE ::= {
##         WITH SYNTAX         UTF8String -- contains XML-encoded privilege policy information
##         ID                  id-at-xMLPprotPrivPolicy }
## 

## -- object identifier assignments --
## -- object classes --
objectidentifier        id-oc-pmiUser 2.5.6.24
objectidentifier        id-oc-pmiAA 2.5.6.25
objectidentifier        id-oc-pmiSOA 2.5.6.26
objectidentifier        id-oc-attCertCRLDistributionPts 2.5.6.27
objectidentifier        id-oc-privilegePolicy 2.5.6.32
objectidentifier        id-oc-pmiDelegationPath 2.5.6.33
objectidentifier        id-oc-protectedPrivilegePolicy 2.5.6.34
## -- directory attributes --
objectidentifier        id-at-attributeCertificate 2.5.4.58
objectidentifier        id-at-attributeCertificateRevocationList 2.5.4.59
objectidentifier        id-at-aACertificate 2.5.4.61
objectidentifier        id-at-attributeDescriptorCertificate 2.5.4.62
objectidentifier        id-at-attributeAuthorityRevocationList 2.5.4.63
objectidentifier        id-at-privPolicy 2.5.4.71
objectidentifier        id-at-role 2.5.4.72
objectidentifier        id-at-delegationPath 2.5.4.73
objectidentifier        id-at-protPrivPolicy 2.5.4.74
objectidentifier        id-at-xMLPrivilegeInfo 2.5.4.75
objectidentifier        id-at-xMLPprotPrivPolicy 2.5.4.76
## -- attribute certificate extensions --
## id-ce-authorityAttributeIdentifier       OBJECT IDENTIFIER ::= {id-ce 38}
## id-ce-roleSpecCertIdentifier             OBJECT IDENTIFIER ::= {id-ce 39}
## id-ce-basicAttConstraints                OBJECT IDENTIFIER ::= {id-ce 41}
## id-ce-delegatedNameConstraints           OBJECT IDENTIFIER ::= {id-ce 42}
## id-ce-timeSpecification                  OBJECT IDENTIFIER ::= {id-ce 43}
## id-ce-attributeDescriptor                OBJECT IDENTIFIER ::= {id-ce 48}
## id-ce-userNotice                         OBJECT IDENTIFIER ::= {id-ce 49}
## id-ce-sOAIdentifier                      OBJECT IDENTIFIER ::= {id-ce 50}
## id-ce-acceptableCertPolicies             OBJECT IDENTIFIER ::= {id-ce 52}
## id-ce-targetInformation                  OBJECT IDENTIFIER ::= {id-ce 55}
## id-ce-noRevAvail                         OBJECT IDENTIFIER ::= {id-ce 56}
## id-ce-acceptablePrivilegePolicies        OBJECT IDENTIFIER ::= {id-ce 57}
## id-ce-indirectIssuer                     OBJECT IDENTIFIER ::= {id-ce 61}
## id-ce-noAssertion                        OBJECT IDENTIFIER ::= {id-ce 62}
## id-ce-issuedOnBehalfOf                   OBJECT IDENTIFIER ::= {id-ce 64}
## -- PMI matching rules --
objectidentifier        id-mr 2.5.13
objectidentifier        id-mr-attributeCertificateMatch id-mr:42
objectidentifier        id-mr-attributeCertificateExactMatch id-mr:45
objectidentifier        id-mr-holderIssuerMatch id-mr:46
objectidentifier        id-mr-authAttIdMatch id-mr:53
objectidentifier        id-mr-roleSpecCertIdMatch id-mr:54
objectidentifier        id-mr-basicAttConstraintsMatch id-mr:55
objectidentifier        id-mr-delegatedNameConstraintsMatch id-mr:56
objectidentifier        id-mr-timeSpecMatch id-mr:57
objectidentifier        id-mr-attDescriptorMatch id-mr:58
objectidentifier        id-mr-acceptableCertPoliciesMatch id-mr:59
objectidentifier        id-mr-delegationPathMatch id-mr:61
objectidentifier        id-mr-sOAIdentifierMatch id-mr:66
objectidentifier        id-mr-indirectIssuerMatch id-mr:67
## -- syntaxes --
## NOTE: 1.3.6.1.4.1.4203.666.11.10 is the oid arc assigned by OpenLDAP
## to this work in progress
objectidentifier        AttributeCertificate 1.3.6.1.4.1.4203.666.11.10.2.1
objectidentifier        CertificateList 1.3.6.1.4.1.1466.115.121.1.9
objectidentifier        AttCertPath 1.3.6.1.4.1.4203.666.11.10.2.4
objectidentifier        PolicySyntax 1.3.6.1.4.1.4203.666.11.10.2.5
objectidentifier        RoleSyntax 1.3.6.1.4.1.4203.666.11.10.2.6
#  NOTE: OIDs from <draft-ietf-pkix-ldap-schema-02.txt> (expired)
#objectidentifier       AttributeCertificate 1.2.826.0.1.3344810.7.5
#objectidentifier       AttCertPath 1.2.826.0.1.3344810.7.10
#objectidentifier       PolicySyntax 1.2.826.0.1.3344810.7.17
#objectidentifier       RoleSyntax 1.2.826.0.1.3344810.7.13
##
## Substitute syntaxes
##
## AttCertPath
ldapsyntax ( 1.3.6.1.4.1.4203.666.11.10.2.4
        NAME 'AttCertPath'
        DESC 'X.509 PMI attribute cartificate path: SEQUENCE OF AttributeCertificate'
        X-SUBST '1.3.6.1.4.1.1466.115.121.1.15' )
##
## PolicySyntax
ldapsyntax ( 1.3.6.1.4.1.4203.666.11.10.2.5
        NAME 'PolicySyntax'
        DESC 'X.509 PMI policy syntax'
        X-SUBST '1.3.6.1.4.1.1466.115.121.1.15' )
##
## RoleSyntax
ldapsyntax ( 1.3.6.1.4.1.4203.666.11.10.2.6
        NAME 'RoleSyntax'
        DESC 'X.509 PMI role syntax'
        X-SUBST '1.3.6.1.4.1.1466.115.121.1.15' )
##
## X.509 (08/2005) pp. 71, 86-89
## 
## 14.4.1 Role attribute
attributeType ( id-at-role
        NAME 'role'
        DESC 'X.509 Role attribute, use ;binary'
        SYNTAX RoleSyntax )
## 
## 14.5     XML privilege information attribute
##  -- contains XML-encoded privilege information
attributeType ( id-at-xMLPrivilegeInfo
        NAME 'xmlPrivilegeInfo'
        DESC 'X.509 XML privilege information attribute'
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
## 
## 17.2       PMI Directory attributes
## 
## 17.2.1     Attribute certificate attribute
attributeType ( id-at-attributeCertificate
        NAME 'attributeCertificateAttribute'
        DESC 'X.509 Attribute certificate attribute, use ;binary'
        SYNTAX AttributeCertificate
        EQUALITY attributeCertificateExactMatch )
## 
## 17.2.2     AA certificate attribute
attributeType ( id-at-aACertificate
        NAME 'aACertificate'
        DESC 'X.509 AA certificate attribute, use ;binary'
        SYNTAX AttributeCertificate
        EQUALITY attributeCertificateExactMatch )
## 
## 17.2.3     Attribute descriptor certificate attribute
attributeType ( id-at-attributeDescriptorCertificate
        NAME 'attributeDescriptorCertificate'
        DESC 'X.509 Attribute descriptor certificate attribute, use ;binary'
        SYNTAX AttributeCertificate
        EQUALITY attributeCertificateExactMatch )
## 
## 17.2.4     Attribute certificate revocation list attribute
attributeType ( id-at-attributeCertificateRevocationList
        NAME 'attributeCertificateRevocationList'
        DESC 'X.509 Attribute certificate revocation list attribute, use ;binary'
        SYNTAX CertificateList 
        X-EQUALITY 'certificateListExactMatch, not implemented yet' )
## 
## 17.2.5     AA certificate revocation list attribute
attributeType ( id-at-attributeAuthorityRevocationList
        NAME 'attributeAuthorityRevocationList'
        DESC 'X.509 AA certificate revocation list attribute, use ;binary'
        SYNTAX CertificateList
        X-EQUALITY 'certificateListExactMatch, not implemented yet' )
## 
## 17.2.6     Delegation path attribute
attributeType ( id-at-delegationPath
        NAME 'delegationPath'
        DESC 'X.509 Delegation path attribute, use ;binary'
        SYNTAX AttCertPath )
##     AttCertPath      ::= SEQUENCE OF AttributeCertificate
## 
## 17.2.7     Privilege policy attribute
attributeType ( id-at-privPolicy
        NAME 'privPolicy'
        DESC 'X.509 Privilege policy attribute, use ;binary'
        SYNTAX PolicySyntax )
## 
## 17.2.8     Protected privilege policy attribute
attributeType ( id-at-protPrivPolicy
        NAME 'protPrivPolicy'
        DESC 'X.509 Protected privilege policy attribute, use ;binary'
        SYNTAX AttributeCertificate
        EQUALITY attributeCertificateExactMatch )
## 
## 17.2.9     XML Protected privilege policy attribute
## -- contains XML-encoded privilege policy information
attributeType ( id-at-xMLPprotPrivPolicy
        NAME 'xmlPrivPolicy'
        DESC 'X.509 XML Protected privilege policy attribute'
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
##
## 17.1 PMI directory object classes
## 
## 17.1.1   PMI user object class
##    -- a PMI user (i.e., a "holder")
objectClass ( id-oc-pmiUser
        NAME 'pmiUser'
        DESC 'X.509 PMI user object class'
        SUP top
        AUXILIARY
        MAY ( attributeCertificateAttribute ) )
## 
## 17.1.2     PMI AA object class
##     -- a PMI AA
objectClass ( id-oc-pmiAA
        NAME 'pmiAA'
        DESC 'X.509 PMI AA object class'
        SUP top
        AUXILIARY
        MAY ( aACertificate $
                attributeCertificateRevocationList $
                attributeAuthorityRevocationList
        ) )
## 
## 17.1.3     PMI SOA object class
##     -- a PMI Source of Authority
objectClass ( id-oc-pmiSOA
        NAME 'pmiSOA'
        DESC 'X.509 PMI SOA object class'
        SUP top
        AUXILIARY
        MAY ( attributeCertificateRevocationList $
                attributeAuthorityRevocationList $
                attributeDescriptorCertificate
        ) )
## 
## 17.1.4     Attribute certificate CRL distribution point object class
objectClass ( id-oc-attCertCRLDistributionPts
        NAME 'attCertCRLDistributionPt'
        DESC 'X.509 Attribute certificate CRL distribution point object class'
        SUP top
        AUXILIARY
        MAY ( attributeCertificateRevocationList $
                attributeAuthorityRevocationList
        ) )
## 
## 17.1.5     PMI delegation path
objectClass ( id-oc-pmiDelegationPath
        NAME 'pmiDelegationPath'
        DESC 'X.509 PMI delegation path'
        SUP top
        AUXILIARY
        MAY ( delegationPath ) )
## 
## 17.1.6     Privilege policy object class
objectClass ( id-oc-privilegePolicy
        NAME 'privilegePolicy'
        DESC 'X.509 Privilege policy object class'
        SUP top
        AUXILIARY
        MAY ( privPolicy ) )
## 
## 17.1.7     Protected privilege policy object class
objectClass ( id-oc-protectedPrivilegePolicy
        NAME 'protectedPrivilegePolicy'
        DESC 'X.509 Protected privilege policy object class'
        SUP top
        AUXILIARY
        MAY ( protPrivPolicy ) )
Subversion Repositories configs

(root)/homeserver/etc/openldap/schema/pmi.schema – Rev 9
