# $OpenLDAP$ ## This work is part of OpenLDAP Software . ## ## Copyright 1998-2006 The OpenLDAP Foundation. ## All rights reserved. ## ## Redistribution and use in source and binary forms, with or without ## modification, are permitted only as authorized by the OpenLDAP ## Public License. ## ## A copy of this license is available in the file LICENSE in the ## top-level directory of the distribution or, alternatively, at ## . # DUA schema from draft-joslin-config-schema (a work in progress) # Contents of this file are subject to change (including deletion) # without notice. # # Not recommended for production use! # Use with extreme caution! ## Notes: ## - The matching rule for attributes followReferrals and dereferenceAliases ## has been changed to booleanMatch since their syntax is boolean ## - There was a typo in the name of the dereferenceAliases attributeType ## in the DUAConfigProfile objectClass definition ## - Credit goes to the original Authors # # Application Working Group M. Ansari # INTERNET-DRAFT Sun Microsystems, Inc. # Expires Febuary 2003 L. Howard # PADL Software Pty. Ltd. # B. Joslin [ed.] # Hewlett-Packard Company # # September 15th, 2003 # Intended Category: Informational # # # A Configuration Schema for LDAP Based # Directory User Agents # # #Status of this Memo # # This memo provides information for the Internet community. This # memo does not specify an Internet standard of any kind. Distribu- # tion of this memo is unlimited. # # This document is an Internet-Draft and is in full conformance with # all provisions of Section 10 of RFC2026. # # This document is an Internet-Draft. Internet-Drafts are working # documents of the Internet Engineering Task Force (IETF), its areas, # and its working groups. Note that other groups may also distribute # working documents as Internet-Drafts. # # Internet-Drafts are draft documents valid for a maximum of six # months. Internet-Drafts may be updated, replaced, or made obsolete # by other documents at any time. It is not appropriate to use # Internet-Drafts as reference material or to cite them other than as # a "working draft" or "work in progress". # # To learn the current status of any Internet-Draft, please check the # 1id-abstracts.txt listing contained in the Internet-Drafts Shadow # Directories on ds.internic.net (US East Coast), nic.nordu.net # (Europe), ftp.isi.edu (US West Coast), or munnari.oz.au (Pacific # Rim). # # Distribution of this document is unlimited. # # # Abstract # # This document describes a mechanism for global configuration of # similar directory user agents. This document defines a schema for # configuration of these DUAs that may be discovered using the Light- # weight Directory Access Protocol in RFC 2251[17]. A set of attri- # bute types and an objectclass are proposed, along with specific # guidelines for interpreting them. A significant feature of the # global configuration policy for DUAs is a mechanism that allows # DUAs to re-configure their schema to that of the end user's # environment. This configuration is achieved through attribute and # objectclass mapping. This document is intended to be a skeleton # for future documents that describe configuration of specific DUA # services. # # # [trimmed] # # # 2. General Issues # # The schema defined by this document is defined under the "DUA Con- # figuration Schema." This schema is derived from the OID: iso (1) # org (3) dod (6) internet (1) private (4) enterprises (1) Hewlett- # Packard Company (11) directory (1) LDAP-UX Integration Project (3) # DUA Configuration Schema (1). This OID is represented in this # document by the keystring "DUAConfSchemaOID" # (1.3.6.1.4.1.11.1.3.1). objectidentifier DUAConfSchemaOID 1.3.6.1.4.1.11.1.3.1 # # 2.2 Attributes # # The attributes and classes defined in this document are summarized # below. # # The following attributes are defined in this document: # # preferredServerList # defaultServerList # defaultSearchBase # defaultSearchScope # authenticationMethod # credentialLevel # serviceSearchDescriptor # # # # Joslin [Page 3] # Internet-Draft DUA Configuration Schema October 2002 # # # serviceCredentialLevel # serviceAuthenticationMethod # attributeMap # objectclassMap # searchTimeLimit # bindTimeLimit # followReferrals # dereferenceAliases # profileTTL # # 2.3 Object Classes # # The following object class is defined in this document: # # DUAConfigProfile # # attributeType ( DUAConfSchemaOID:1.0 NAME 'defaultServerList' DESC 'Default LDAP server host address used by a DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.1 NAME 'defaultSearchBase' DESC 'Default LDAP base DN used by a DUA' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.2 NAME 'preferredServerList' DESC 'Preferred LDAP server host addresses to be used by a DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.3 NAME 'searchTimeLimit' DESC 'Maximum time in seconds a DUA should allow for a search to complete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.4 NAME 'bindTimeLimit' DESC 'Maximum time in seconds a DUA should allow for the bind operation to complete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.5 NAME 'followReferrals' DESC 'Tells DUA if it should follow referrals returned by a DSA search result' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.16 NAME 'dereferenceAliases' DESC 'Tells DUA if it should dereference aliases' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.6 NAME 'authenticationMethod' DESC 'A keystring which identifies the type of authentication method used to contact the DSA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.7 NAME 'profileTTL' DESC 'Time to live, in seconds, before a client DUA should re-read this configuration profile' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.14 NAME 'serviceSearchDescriptor' DESC 'LDAP search descriptor list used by a DUA' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) attributeType ( DUAConfSchemaOID:1.9 NAME 'attributeMap' DESC 'Attribute mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributeType ( DUAConfSchemaOID:1.10 NAME 'credentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.11 NAME 'objectclassMap' DESC 'Objectclass mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributeType ( DUAConfSchemaOID:1.12 NAME 'defaultSearchScope' DESC 'Default search scope used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) attributeType ( DUAConfSchemaOID:1.13 NAME 'serviceCredentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server for a specific service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) attributeType ( DUAConfSchemaOID:1.15 NAME 'serviceAuthenticationMethod' DESC 'Authentication method used by a service of the DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) # # 4. Class Definition # # The objectclass below is constructed from the attributes defined in # 3, with the exception of the cn attribute, which is defined in RFC # 2256 [8]. cn is used to represent the name of the DUA configura- # tion profile. # objectClass ( DUAConfSchemaOID:2.5 NAME 'DUAConfigProfile' SUP top STRUCTURAL DESC 'Abstraction of a base configuration for a DUA' MUST ( cn ) MAY ( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ dereferenceAliases $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL ) )