2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT S. Legg
|
2004-08-28 02:41:02 +08:00
|
|
|
|
draft-legg-ldap-acm-bac-03.txt Adacel Technologies
|
|
|
|
|
|
Intended Category: Standards Track June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
Updates: RFC 2252
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Lightweight Directory Access Protocol (LDAP):
|
|
|
|
|
|
Basic and Simplified Access Control
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Copyright (C) The Internet Society (2004). All Rights Reserved.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Status of this Memo
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
This document is an Internet-Draft and is in full conformance with
|
|
|
|
|
|
all provisions of Section 10 of RFC2026.
|
|
|
|
|
|
|
|
|
|
|
|
Internet-Drafts are working documents of the Internet Engineering
|
|
|
|
|
|
Task Force (IETF), its areas, and its working groups. Note that
|
|
|
|
|
|
other groups may also distribute working documents as
|
|
|
|
|
|
Internet-Drafts.
|
|
|
|
|
|
|
|
|
|
|
|
Internet-Drafts are draft documents valid for a maximum of six months
|
|
|
|
|
|
and may be updated, replaced, or obsoleted by other documents at any
|
|
|
|
|
|
time. It is inappropriate to use Internet-Drafts as reference
|
|
|
|
|
|
material or to cite them other than as "work in progress".
|
|
|
|
|
|
|
|
|
|
|
|
The list of current Internet-Drafts can be accessed at
|
|
|
|
|
|
http://www.ietf.org/ietf/1id-abstracts.txt
|
|
|
|
|
|
|
|
|
|
|
|
The list of Internet-Draft Shadow Directories can be accessed at
|
|
|
|
|
|
http://www.ietf.org/shadow.html.
|
|
|
|
|
|
|
|
|
|
|
|
Distribution of this document is unlimited. Comments should be sent
|
2004-08-28 02:41:02 +08:00
|
|
|
|
to the author.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
This Internet-Draft expires on 16 December 2004.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Abstract
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
An access control scheme describes the means by which access to
|
|
|
|
|
|
directory information and potentially to access rights themselves may
|
|
|
|
|
|
be controlled. This document adapts the X.500 directory Basic Access
|
|
|
|
|
|
Control and Simplied Access Control schemes for use by the
|
|
|
|
|
|
Lightweight Directory Access Protocol.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 1]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table of Contents
|
|
|
|
|
|
|
|
|
|
|
|
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
|
|
|
|
|
|
2. Conventions. . . . . . . . . . . . . . . . . . . . . . . . . . 3
|
|
|
|
|
|
3. Basic Access Control . . . . . . . . . . . . . . . . . . . . . 4
|
|
|
|
|
|
3.1. Permissions. . . . . . . . . . . . . . . . . . . . . . . 5
|
|
|
|
|
|
3.1.1. Read . . . . . . . . . . . . . . . . . . . . . . 5
|
|
|
|
|
|
3.1.2. Compare. . . . . . . . . . . . . . . . . . . . . 6
|
|
|
|
|
|
3.1.3. Browse . . . . . . . . . . . . . . . . . . . . . 6
|
|
|
|
|
|
3.1.4. ReturnDN . . . . . . . . . . . . . . . . . . . . 6
|
|
|
|
|
|
3.1.5. FilterMatch. . . . . . . . . . . . . . . . . . . 6
|
|
|
|
|
|
3.1.6. Modify . . . . . . . . . . . . . . . . . . . . . 6
|
|
|
|
|
|
3.1.7. Add. . . . . . . . . . . . . . . . . . . . . . . 6
|
|
|
|
|
|
3.1.8. Remove . . . . . . . . . . . . . . . . . . . . . 7
|
|
|
|
|
|
3.1.9. DiscloseOnError. . . . . . . . . . . . . . . . . 7
|
|
|
|
|
|
3.1.10. Rename . . . . . . . . . . . . . . . . . . . . . 7
|
|
|
|
|
|
3.1.11. Export . . . . . . . . . . . . . . . . . . . . . 7
|
|
|
|
|
|
3.1.12. Import . . . . . . . . . . . . . . . . . . . . . 8
|
|
|
|
|
|
3.1.13. Invoke . . . . . . . . . . . . . . . . . . . . . 8
|
|
|
|
|
|
3.2. Representation of Access Control Information . . . . . . 8
|
|
|
|
|
|
3.2.1. Identification Tag . . . . . . . . . . . . . . . 11
|
|
|
|
|
|
3.2.2. Precedence . . . . . . . . . . . . . . . . . . . 11
|
|
|
|
|
|
3.2.3. Authentication Level . . . . . . . . . . . . . . 11
|
|
|
|
|
|
3.2.4. itemFirst and userFirst Components . . . . . . . 12
|
|
|
|
|
|
3.2.5. Determining Group Membership . . . . . . . . . . 16
|
|
|
|
|
|
3.3. ACI Operational Attributes . . . . . . . . . . . . . . . 17
|
|
|
|
|
|
3.3.1. Prescriptive ACI . . . . . . . . . . . . . . . . 17
|
|
|
|
|
|
3.3.2. Entry ACI. . . . . . . . . . . . . . . . . . . . 17
|
|
|
|
|
|
3.3.3. Subentry ACI . . . . . . . . . . . . . . . . . . 18
|
|
|
|
|
|
3.3.4. Protecting the ACI . . . . . . . . . . . . . . . 18
|
|
|
|
|
|
3.4. Access Control Decision Points for LDAP Operations . . . 18
|
|
|
|
|
|
3.4.1. Common Elements of Procedure . . . . . . . . . . 19
|
|
|
|
|
|
3.4.1.1. Alias Dereferencing. . . . . . . . . . 19
|
|
|
|
|
|
3.4.1.2. Return of Names in Errors. . . . . . . 19
|
|
|
|
|
|
3.4.1.3. Non-disclosure of Entry Existence. . . 20
|
|
|
|
|
|
3.4.2. Compare Operation Decision Points. . . . . . . . 20
|
|
|
|
|
|
3.4.3. Search Operation Decision Points . . . . . . . . 20
|
|
|
|
|
|
3.4.4. Add Operation Decision Points. . . . . . . . . . 23
|
|
|
|
|
|
3.4.5. Delete Operation Decision Points . . . . . . . . 24
|
|
|
|
|
|
3.4.6. Modify Operation Decision Points . . . . . . . . 24
|
|
|
|
|
|
3.4.7. Modify DN Operation Decision Points. . . . . . . 25
|
|
|
|
|
|
3.5. Access Control Decision Function . . . . . . . . . . . . 26
|
|
|
|
|
|
3.5.1. Inputs . . . . . . . . . . . . . . . . . . . . . 26
|
|
|
|
|
|
3.5.2. Tuples . . . . . . . . . . . . . . . . . . . . . 26
|
|
|
|
|
|
3.5.3. Discarding Irrelevant Tuples . . . . . . . . . . 27
|
|
|
|
|
|
3.5.4. Highest Precedence and Specificity . . . . . . . 28
|
|
|
|
|
|
4. Simplified Access Control. . . . . . . . . . . . . . . . . . . 28
|
|
|
|
|
|
5. Security Considerations. . . . . . . . . . . . . . . . . . . . 29
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 2]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 29
|
|
|
|
|
|
7. IANA Considerations. . . . . . . . . . . . . . . . . . . . . . 29
|
|
|
|
|
|
Appendix A. LDAP Specific Encoding for the ACI Item Syntax . . . . 30
|
|
|
|
|
|
Normative References . . . . . . . . . . . . . . . . . . . . . . . 39
|
|
|
|
|
|
Informative References . . . . . . . . . . . . . . . . . . . . . . 40
|
|
|
|
|
|
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 40
|
|
|
|
|
|
Full Copyright Statement . . . . . . . . . . . . . . . . . . . . . 40
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
1. Introduction
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
An access control scheme describes the means by which access to
|
|
|
|
|
|
directory information and potentially to access rights themselves may
|
|
|
|
|
|
be controlled. Control of access to information means the prevention
|
|
|
|
|
|
of unauthorized detection, disclosure, or modification of that
|
|
|
|
|
|
information. The definition of an access control scheme in the
|
|
|
|
|
|
context of a Lightweight Directory Access Protocol (LDAP) [RFC3371]
|
|
|
|
|
|
directory includes methods to specify Access Control Information
|
|
|
|
|
|
(ACI), and to enforce access rights defined by that ACI.
|
|
|
|
|
|
|
|
|
|
|
|
This document adapts the X.500 Basic Access Control and Simplied
|
|
|
|
|
|
Access Control schemes [X501] for use in LDAP. Both schemes conform
|
2004-08-28 02:41:02 +08:00
|
|
|
|
to, and make use of, the access control administrative framework for
|
|
|
|
|
|
LDAP [ACA].
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Section 3 describes the Basic Access Control scheme and defines how
|
2003-06-01 06:47:07 +08:00
|
|
|
|
it applies to LDAP operations [RFC2251].
|
|
|
|
|
|
|
|
|
|
|
|
Simplified Access Control is a functional subset of the Basic Access
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Control scheme. This subset is described in Section 4.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
As a matter of security policy, an implementation supporting Basic
|
|
|
|
|
|
Access Control or Simplified Access Control is permitted to grant or
|
2004-08-28 02:41:02 +08:00
|
|
|
|
deny any form of access to particular attributes (e.g., password
|
2003-06-01 06:47:07 +08:00
|
|
|
|
attributes) irrespective of access controls which may otherwise
|
|
|
|
|
|
apply. However, since such security policy has no standardized
|
|
|
|
|
|
representation, it cannot be propagated in replicated information.
|
|
|
|
|
|
|
|
|
|
|
|
This document is derived from, and duplicates substantial portions
|
2004-08-28 02:41:02 +08:00
|
|
|
|
of, Section 8 of X.501 [X501], and selected extracts from X.511
|
|
|
|
|
|
[X511].
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
2. Conventions
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
|
|
|
|
|
|
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
|
2004-08-28 02:41:02 +08:00
|
|
|
|
document are to be interpreted as described in BCP 14, RFC 2119
|
|
|
|
|
|
[RFC2119].
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 3]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Schema definitions are provided using LDAP description formats
|
|
|
|
|
|
[RFC2252]. Note that the LDAP descriptions have been rendered with
|
|
|
|
|
|
additional white-space and line breaks for the sake of readability.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3. Basic Access Control
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
This section describes the functionality of the Basic Access Control
|
|
|
|
|
|
scheme.
|
|
|
|
|
|
|
|
|
|
|
|
When Basic Access Control is used, the accessControlScheme
|
|
|
|
|
|
operational attribute [ACA] SHALL have the value basic-access-control
|
|
|
|
|
|
(2.5.28.1).
|
|
|
|
|
|
|
|
|
|
|
|
This LDAP profile for Basic Access Control defines, for every LDAP
|
|
|
|
|
|
operation, one or more points at which access control decisions take
|
|
|
|
|
|
place. An access control decision will involve a requestor,
|
|
|
|
|
|
protected items, and permissions.
|
|
|
|
|
|
|
|
|
|
|
|
A requestor is the user requesting the operation. Basic Access
|
|
|
|
|
|
Control requires a user's authorization identity to be represented as
|
|
|
|
|
|
a distinguished name (with an optional unique identifier). The
|
|
|
|
|
|
mapping of the authentication identity to an authorization identity,
|
|
|
|
|
|
and the mapping of the authorization identity to a distinguished name
|
|
|
|
|
|
and optional unique identifier, are outside the scope of this
|
|
|
|
|
|
document.
|
|
|
|
|
|
|
|
|
|
|
|
A protected item is the element of directory information being
|
|
|
|
|
|
accessed. The protected items are entries, attributes, attribute
|
|
|
|
|
|
values and distinguished names. Access to each protected item can be
|
|
|
|
|
|
separately controlled through ACI.
|
|
|
|
|
|
|
|
|
|
|
|
A permission is a particular right necessary to complete a portion of
|
|
|
|
|
|
the operation.
|
|
|
|
|
|
|
|
|
|
|
|
The Access Control Information, which is used to make access control
|
|
|
|
|
|
decisions, associates protected items and user classes with
|
|
|
|
|
|
permissions. ACI is represented in the directory as values of
|
|
|
|
|
|
operational attributes with the ACI Item syntax [RFC2252]. Each such
|
|
|
|
|
|
value is referred to as an ACI item.
|
|
|
|
|
|
|
|
|
|
|
|
The scope of access controls can be a single entry or a collection of
|
|
|
|
|
|
entries that are logically related by being within the scope of an
|
|
|
|
|
|
access control subentry of an administrative point (see [ACA]).
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
The Access Control Decision Function (ACDF) (Section 3.5) is used to
|
2003-06-01 06:47:07 +08:00
|
|
|
|
decide whether a particular requestor has a particular access right
|
|
|
|
|
|
by virtue of applicable ACI items.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 4]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Access to DSEs and operational attributes is controlled in the same
|
|
|
|
|
|
way as for entries and user attributes.
|
|
|
|
|
|
|
|
|
|
|
|
For query purposes, collective attributes [COLLECT] that are
|
|
|
|
|
|
associated with an entry are protected precisely as if they were
|
|
|
|
|
|
attributes actually stored in that entry.
|
|
|
|
|
|
|
|
|
|
|
|
For the purposes of modification, collective attributes are
|
|
|
|
|
|
associated with the subentry that holds them, not with entries within
|
|
|
|
|
|
the scope of the subentry. Modify-related access controls are
|
|
|
|
|
|
therefore not relevant to collective attributes, except when they
|
|
|
|
|
|
apply to the collective attribute and its values within the subentry.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1. Permissions
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Access is controlled by granting or denying permissions. Access is
|
|
|
|
|
|
allowed only when there is an explicitly provided grant present in
|
|
|
|
|
|
the ACI used to make the access control decision. The only default
|
|
|
|
|
|
access decision provided in the model is to deny access in the
|
|
|
|
|
|
absence of explicit ACI that grants access. All other factors being
|
|
|
|
|
|
equal, a denial specified in ACI always overrides a grant.
|
|
|
|
|
|
|
|
|
|
|
|
Certain combinations of grants or denials are illogical, but it is
|
|
|
|
|
|
the responsibility of directory clients, rather than the directory
|
|
|
|
|
|
server, to ensure that such combinations are absent.
|
|
|
|
|
|
|
|
|
|
|
|
The decision whether or not to permit access to an entry or its
|
|
|
|
|
|
contents is strictly determined by the position of the entry in the
|
|
|
|
|
|
Directory Information Tree (DIT), in terms of its distinguished name,
|
|
|
|
|
|
and is independent of how the directory server locates that entry.
|
|
|
|
|
|
|
|
|
|
|
|
The following sections introduce the permissions by indicating the
|
|
|
|
|
|
intent associated with the granting of each. The actual influence of
|
|
|
|
|
|
a particular granted permission on access control decisions are,
|
|
|
|
|
|
however, determined by the ACDF and the access control decision
|
2004-08-28 02:41:02 +08:00
|
|
|
|
points for each LDAP operation, described in detail in Section 3.4.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.1. Read
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, Read permits the entry to be accessed using
|
|
|
|
|
|
LDAP Compare and baseObject Search operations, but does not imply
|
|
|
|
|
|
access to all the attributes and values.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute type, Read permits the attribute type to
|
|
|
|
|
|
be returned as entry information in a Search result. Read or Browse
|
|
|
|
|
|
permission for the entry is a prerequisite.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
If granted for an attribute value, Read permits the attribute value
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 5]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
to be returned as entry information in a Search result. Read or
|
|
|
|
|
|
Browse permission for the entry and Read permission for the attribute
|
|
|
|
|
|
type are prerequisites.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.2. Compare
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an attribute type, Compare permits the attribute type
|
|
|
|
|
|
to be tested by the assertion in an LDAP Compare operation. Read
|
|
|
|
|
|
permission for the entry is a prerequisite.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute value, Compare permits the value to be
|
|
|
|
|
|
tested by the assertion in an LDAP Compare operation. Read
|
|
|
|
|
|
permission for the entry and Compare permission for the attribute
|
|
|
|
|
|
type are prerequisites.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.3. Browse
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, Browse permits the entry to be accessed by
|
|
|
|
|
|
the LDAP Search operation, including baseObject searches, but does
|
|
|
|
|
|
not imply access to all the attributes and values.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.4. ReturnDN
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, ReturnDN allows the distinguished name of
|
|
|
|
|
|
the entry to be disclosed in a search result.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.5. FilterMatch
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an attribute type, Filtermatch permits the attribute
|
|
|
|
|
|
type to satisfy a Filter item.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute value, Filtermatch permits the attribute
|
|
|
|
|
|
value to satisfy a Filter item. FilterMatch permission for the
|
|
|
|
|
|
attribute type is a prerequisite.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.6. Modify
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, Modify permits the information contained
|
|
|
|
|
|
within an entry to be modified by the LDAP Modify operation, subject
|
|
|
|
|
|
to controls on the attribute types and values.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.7. Add
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
If granted for an entry, Add permits creation of an entry in the DIT,
|
|
|
|
|
|
subject to being able to add all specified attributes and attribute
|
|
|
|
|
|
values. Add permission granted for an entry is ineffective if Add
|
|
|
|
|
|
permission is not also granted for at least the mandatory attributes
|
|
|
|
|
|
and their values. There is no specific "add subordinate permission".
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 6]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Permission to add an entry is controlled using prescriptive ACI.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute type, Add permits adding a new attribute,
|
|
|
|
|
|
subject to being able to add all specified attribute values. Add or
|
|
|
|
|
|
Modify permission for the entry is a prerequisite.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute value, Add permits adding that value to
|
|
|
|
|
|
an existing attribute. Add or Modify permission for the entry is a
|
|
|
|
|
|
prerequisite.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.8. Remove
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, Remove permits the entry to be removed from
|
|
|
|
|
|
the DIT regardless of controls on attributes or attribute values
|
|
|
|
|
|
within the entry.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute, Remove permits removing an attribute,
|
|
|
|
|
|
subject to being able to remove any explicitly specified attribute
|
|
|
|
|
|
values. Remove permission for values not explicitly specified is not
|
|
|
|
|
|
required.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute value, Remove permits the attribute value
|
|
|
|
|
|
to be removed from an existing attribute.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.9. DiscloseOnError
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, DiscloseOnError permits the name of an entry
|
|
|
|
|
|
to be disclosed in an error result.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute, DiscloseOnError permits the presence of
|
|
|
|
|
|
the attribute to be disclosed by an error.
|
|
|
|
|
|
|
|
|
|
|
|
If granted for an attribute value, DiscloseOnError permits the
|
|
|
|
|
|
presence of the attribute value to be disclosed by an error.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.10. Rename
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, Rename permits an entry to be renamed with a
|
|
|
|
|
|
new RDN. No permissions are required for the attributes and values
|
|
|
|
|
|
altered by the operation, even if they are added or removed as a
|
|
|
|
|
|
result of the changes to the RDN.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.11. Export
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, Export permits the entry and its
|
|
|
|
|
|
subordinates, if any, to be removed from the current location and
|
|
|
|
|
|
placed in a new location, subject to the granting of Import
|
|
|
|
|
|
permission at the destination.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 7]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
If the last RDN is changed, Rename permission at the current location
|
|
|
|
|
|
is also required
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.12. Import
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If granted for an entry, Import permits an entry and its
|
|
|
|
|
|
subordinates, if any, to be placed at the location to which the
|
|
|
|
|
|
permission applies, subject to the granting of Export permission at
|
|
|
|
|
|
the source location.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.1.13. Invoke
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Invoke, if granted for an operational attribute, or value thereof,
|
|
|
|
|
|
permits the directory server to carry out some function associated
|
|
|
|
|
|
with the operational attribute on behalf of the user. The specific
|
|
|
|
|
|
function carried out by invocation depends on the attribute. No
|
|
|
|
|
|
other permissions are required by user for the operational attribute,
|
|
|
|
|
|
or on the entry/subentry that holds it, in order for it to be
|
|
|
|
|
|
"invoked".
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.2. Representation of Access Control Information
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Access Control Information is represented as a set of ACI items,
|
|
|
|
|
|
where each ACI item grants or denies permissions in regard to certain
|
|
|
|
|
|
specified users and protected items.
|
|
|
|
|
|
|
|
|
|
|
|
An ACI item is represented as a value of an operational attribute
|
|
|
|
|
|
with the ACI Item syntax (1.3.6.1.4.1.1466.115.121.1.1) [RFC2252].
|
|
|
|
|
|
|
|
|
|
|
|
This document updates [RFC2252] by specifying a human-readable
|
|
|
|
|
|
LDAP-specific encoding for ACI items. The LDAP-specific encoding of
|
|
|
|
|
|
values of the ACI Item syntax is defined by the Generic String
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Encoding Rules [GSER]. Appendix A provides an equivalent ABNF for
|
|
|
|
|
|
this syntax.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
For convenience in specifying access control policies, the ACI Item
|
|
|
|
|
|
syntax provides the means to identify collections of related items,
|
|
|
|
|
|
such as attributes in an entry or all attribute values of a given
|
|
|
|
|
|
attribute, and to specify a common protection for them.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
The ACI Item syntax corresponds to the ACIItem ASN.1 [ASN1] type
|
|
|
|
|
|
defined in X.501 [X501]. It is reproduced here for convenience:
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
ACIItem ::= SEQUENCE {
|
|
|
|
|
|
identificationTag DirectoryString { ub-tag },
|
|
|
|
|
|
precedence Precedence,
|
|
|
|
|
|
authenticationLevel AuthenticationLevel,
|
|
|
|
|
|
itemOrUserFirst CHOICE {
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 8]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
itemFirst [0] SEQUENCE {
|
|
|
|
|
|
protectedItems ProtectedItems,
|
|
|
|
|
|
itemPermissions SET OF ItemPermission },
|
|
|
|
|
|
userFirst [1] SEQUENCE {
|
|
|
|
|
|
userClasses UserClasses,
|
|
|
|
|
|
userPermissions SET OF UserPermission } } }
|
|
|
|
|
|
|
|
|
|
|
|
Precedence ::= INTEGER (0..255)
|
|
|
|
|
|
|
|
|
|
|
|
ProtectedItems ::= SEQUENCE {
|
|
|
|
|
|
entry [0] NULL OPTIONAL,
|
|
|
|
|
|
allUserAttributeTypes [1] NULL OPTIONAL,
|
|
|
|
|
|
attributeType [2] SET SIZE (1..MAX) OF
|
|
|
|
|
|
AttributeType OPTIONAL,
|
|
|
|
|
|
allAttributeValues [3] SET SIZE (1..MAX) OF
|
|
|
|
|
|
AttributeType OPTIONAL,
|
|
|
|
|
|
allUserAttributeTypesAndValues [4] NULL OPTIONAL,
|
|
|
|
|
|
attributeValue [5] SET SIZE (1..MAX) OF
|
|
|
|
|
|
AttributeTypeAndValue OPTIONAL,
|
|
|
|
|
|
selfValue [6] SET SIZE (1..MAX) OF
|
|
|
|
|
|
AttributeType OPTIONAL,
|
|
|
|
|
|
rangeOfValues [7] Filter OPTIONAL,
|
|
|
|
|
|
maxValueCount [8] SET SIZE (1..MAX) OF
|
|
|
|
|
|
MaxValueCount OPTIONAL,
|
|
|
|
|
|
maxImmSub [9] INTEGER OPTIONAL,
|
|
|
|
|
|
restrictedBy [10] SET SIZE (1..MAX) OF
|
|
|
|
|
|
RestrictedValue OPTIONAL,
|
|
|
|
|
|
contexts [11] SET SIZE (1..MAX) OF
|
|
|
|
|
|
ContextAssertion OPTIONAL,
|
|
|
|
|
|
classes [12] Refinement OPTIONAL }
|
|
|
|
|
|
|
|
|
|
|
|
MaxValueCount ::= SEQUENCE {
|
|
|
|
|
|
type AttributeType,
|
|
|
|
|
|
maxCount INTEGER }
|
|
|
|
|
|
|
|
|
|
|
|
RestrictedValue ::= SEQUENCE {
|
|
|
|
|
|
type AttributeType,
|
|
|
|
|
|
valuesIn AttributeType }
|
|
|
|
|
|
|
|
|
|
|
|
UserClasses ::= SEQUENCE {
|
|
|
|
|
|
allUsers [0] NULL OPTIONAL,
|
|
|
|
|
|
thisEntry [1] NULL OPTIONAL,
|
|
|
|
|
|
name [2] SET SIZE (1..MAX) OF NameAndOptionalUID OPTIONAL,
|
|
|
|
|
|
userGroup [3] SET SIZE (1..MAX) OF NameAndOptionalUID OPTIONAL,
|
|
|
|
|
|
-- dn component shall be the name of an
|
|
|
|
|
|
-- entry of GroupOfUniqueNames
|
|
|
|
|
|
subtree [4] SET SIZE (1..MAX) OF
|
|
|
|
|
|
SubtreeSpecification OPTIONAL }
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 9]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
NameAndOptionalUID ::= SEQUENCE {
|
|
|
|
|
|
dn DistinguishedName,
|
|
|
|
|
|
uid UniqueIdentifier OPTIONAL }
|
|
|
|
|
|
|
|
|
|
|
|
UniqueIdentifier ::= BIT STRING
|
|
|
|
|
|
|
|
|
|
|
|
ItemPermission ::= SEQUENCE {
|
|
|
|
|
|
precedence Precedence OPTIONAL,
|
|
|
|
|
|
-- defaults to precedence in ACIItem
|
|
|
|
|
|
userClasses UserClasses,
|
|
|
|
|
|
grantsAndDenials GrantsAndDenials }
|
|
|
|
|
|
|
|
|
|
|
|
UserPermission ::= SEQUENCE {
|
|
|
|
|
|
precedence Precedence OPTIONAL,
|
|
|
|
|
|
-- defaults to precedence in ACIItem
|
|
|
|
|
|
protectedItems ProtectedItems,
|
|
|
|
|
|
grantsAndDenials GrantsAndDenials }
|
|
|
|
|
|
|
|
|
|
|
|
AuthenticationLevel ::= CHOICE {
|
|
|
|
|
|
basicLevels SEQUENCE {
|
|
|
|
|
|
level ENUMERATED { none(0), simple(1), strong(2) },
|
|
|
|
|
|
localQualifier INTEGER OPTIONAL,
|
|
|
|
|
|
signed BOOLEAN DEFAULT FALSE },
|
|
|
|
|
|
other EXTERNAL }
|
|
|
|
|
|
|
|
|
|
|
|
GrantsAndDenials ::= BIT STRING {
|
|
|
|
|
|
-- permissions that may be used in conjunction
|
|
|
|
|
|
-- with any component of ProtectedItems
|
|
|
|
|
|
grantAdd (0),
|
|
|
|
|
|
denyAdd (1),
|
|
|
|
|
|
grantDiscloseOnError (2),
|
|
|
|
|
|
denyDiscloseOnError (3),
|
|
|
|
|
|
grantRead (4),
|
|
|
|
|
|
denyRead (5),
|
|
|
|
|
|
grantRemove (6),
|
|
|
|
|
|
denyRemove (7),
|
|
|
|
|
|
-- permissions that may be used only in conjunction
|
|
|
|
|
|
-- with the entry component
|
|
|
|
|
|
grantBrowse (8),
|
|
|
|
|
|
denyBrowse (9),
|
|
|
|
|
|
grantExport (10),
|
|
|
|
|
|
denyExport (11),
|
|
|
|
|
|
grantImport (12),
|
|
|
|
|
|
denyImport (13),
|
|
|
|
|
|
grantModify (14),
|
|
|
|
|
|
denyModify (15),
|
|
|
|
|
|
grantRename (16),
|
|
|
|
|
|
denyRename (17),
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 10]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
grantReturnDN (18),
|
|
|
|
|
|
denyReturnDN (19),
|
|
|
|
|
|
-- permissions that may be used in conjunction
|
|
|
|
|
|
-- with any component, except entry, of ProtectedItems
|
|
|
|
|
|
grantCompare (20),
|
|
|
|
|
|
denyCompare (21),
|
|
|
|
|
|
grantFilterMatch (22),
|
|
|
|
|
|
denyFilterMatch (23),
|
|
|
|
|
|
grantInvoke (24),
|
|
|
|
|
|
denyInvoke (25) }
|
|
|
|
|
|
|
|
|
|
|
|
AttributeTypeAndValue ::= SEQUENCE {
|
|
|
|
|
|
type ATTRIBUTE.&id ({SupportedAttributes}),
|
|
|
|
|
|
value ATTRIBUTE.&Type ({SupportedAttributes}{@type}) }
|
|
|
|
|
|
|
|
|
|
|
|
The SubtreeSpecification and Refinement ASN.1 types are defined in
|
2004-08-28 02:41:02 +08:00
|
|
|
|
X.501 [X501], and separately described for LDAP [SUBENTRY].
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The following sections describe the components of ACIItem.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.2.1. Identification Tag
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
identificationTag is used to identify a particular ACI item. This is
|
|
|
|
|
|
used to discriminate among individual ACI items for the purposes of
|
|
|
|
|
|
protection and administration.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.2.2. Precedence
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Precedence is used to control the relative order in which ACI items
|
|
|
|
|
|
are considered during the course of making an access control decision
|
|
|
|
|
|
using the ACDF. ACI items having higher precedence values prevail
|
|
|
|
|
|
over others with lower precedence values, other factors being equal.
|
|
|
|
|
|
Precedence values are integers and are compared as such.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.2.3. Authentication Level
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
AuthenticationLevel defines the minimum requestor authentication
|
|
|
|
|
|
level required for this ACI item. It has two forms:
|
|
|
|
|
|
|
|
|
|
|
|
1) basicLevels: which indicates the level of authentication,
|
|
|
|
|
|
optionally qualified by positive or negative integer
|
|
|
|
|
|
localQualifier.
|
|
|
|
|
|
|
|
|
|
|
|
2) other: an externally defined measure.
|
|
|
|
|
|
|
|
|
|
|
|
When basicLevels is used, an AuthenticationLevel consisting of a
|
|
|
|
|
|
level and optional localQualifier SHALL be assigned to the requestor
|
|
|
|
|
|
by the directory server according to local policy. For a requestor's
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 11]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
authentication level to meet or exceed the minimum requirement, the
|
|
|
|
|
|
requestor's level must meet or exceed that specified in the ACI item,
|
|
|
|
|
|
and in addition the requestor's localQualifier must be arithmetically
|
|
|
|
|
|
greater than or equal to that of the ACI item. Strong authentication
|
|
|
|
|
|
of the requestor is considered to exceed a requirement for simple or
|
|
|
|
|
|
no authentication, and simple authentication exceeds a requirement
|
|
|
|
|
|
for no authentication. For access control purposes, the "simple"
|
|
|
|
|
|
authentication level requires at least a password; the case of
|
|
|
|
|
|
identification only, with no password supplied, is considered "none".
|
|
|
|
|
|
If a localQualifier is not specified in the ACI item, then the
|
|
|
|
|
|
requestor need not have a corresponding value (if such a value is
|
|
|
|
|
|
present it is ignored).
|
|
|
|
|
|
|
|
|
|
|
|
The signed component of basicLevels is ignored for LDAP.
|
|
|
|
|
|
|
|
|
|
|
|
When other is used, an appropriate AuthenticationLevel shall be
|
|
|
|
|
|
assigned to the requestor by the directory server according to local
|
|
|
|
|
|
policy. The form of this AuthenticationLevel and the method by which
|
|
|
|
|
|
it is compared with the AuthenticationLevel in the ACI is a local
|
|
|
|
|
|
matter.
|
|
|
|
|
|
|
|
|
|
|
|
An authentication level associated with an explicit grant indicates
|
|
|
|
|
|
the minimum level to which a requestor shall be authenticated in
|
|
|
|
|
|
order to be granted access.
|
|
|
|
|
|
|
|
|
|
|
|
An authentication level associated with an explicit deny indicates
|
|
|
|
|
|
the minimum level to which a requestor shall be authenticated in
|
|
|
|
|
|
order not to be denied access. For example, an ACI item that denies
|
|
|
|
|
|
access to a particular user class and requires strong authentication
|
|
|
|
|
|
will deny access to all requestors who cannot prove, by means of a
|
|
|
|
|
|
strongly authenticated identity, that they are not in that user
|
|
|
|
|
|
class.
|
|
|
|
|
|
|
|
|
|
|
|
The directory server may base authentication level on factors other
|
|
|
|
|
|
than values received in protocol exchanges.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.2.4. itemFirst and userFirst Components
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Each ACI item contains a choice of itemFirst or userFirst. The
|
|
|
|
|
|
choice allows grouping of permissions depending on whether they are
|
|
|
|
|
|
most conveniently grouped by user classes or by protected items. The
|
|
|
|
|
|
itemFirst and userFirst components are equivalent in the sense that
|
|
|
|
|
|
they capture the same access control information; however, they
|
|
|
|
|
|
organize that information differently. The choice between them is
|
|
|
|
|
|
based on administrative convenience. The subcomponents of itemFirst
|
|
|
|
|
|
and userFirst are described below.
|
|
|
|
|
|
|
|
|
|
|
|
a) ProtectedItems defines the items to which the specified access
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 12]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
controls apply. It is defined as a set selected from the
|
|
|
|
|
|
following:
|
|
|
|
|
|
|
|
|
|
|
|
- entry means the entry contents as a whole. It does not
|
|
|
|
|
|
necessarily include the information in these entries. This
|
|
|
|
|
|
element SHALL be ignored if the classes component is present,
|
|
|
|
|
|
since this latter element selects protected entries on the basis
|
|
|
|
|
|
of their object class.
|
|
|
|
|
|
|
|
|
|
|
|
- allUserAttributeTypes means all user attribute type information
|
|
|
|
|
|
associated with the entry, but not values associated with those
|
|
|
|
|
|
attributes.
|
|
|
|
|
|
|
|
|
|
|
|
- allUserAttributeTypesAndValues means all user attribute
|
|
|
|
|
|
information associated with the entry, including all values of
|
|
|
|
|
|
all user attributes.
|
|
|
|
|
|
|
|
|
|
|
|
The allUserAttributeTypes and allUserAttributeTypesAndValues
|
|
|
|
|
|
components do not include operational attributes, which MUST be
|
|
|
|
|
|
specified on a per attribute basis, using attributeType,
|
|
|
|
|
|
allAttributeValues or attributeValue.
|
|
|
|
|
|
|
|
|
|
|
|
- attributeType means attribute type information pertaining to
|
|
|
|
|
|
specific attributes but not values associated with the type.
|
|
|
|
|
|
|
|
|
|
|
|
- allAttributeValues means all attribute value information
|
|
|
|
|
|
pertaining to specific attributes.
|
|
|
|
|
|
|
|
|
|
|
|
- attributeValue means specific values of specific attribute
|
|
|
|
|
|
types.
|
|
|
|
|
|
|
|
|
|
|
|
- selfValue means the attribute values of the specified attribute
|
|
|
|
|
|
types that match the distinguished name (and unique identifier)
|
|
|
|
|
|
of the requestor. It can only apply in the specific case where
|
|
|
|
|
|
the attribute specified is of DN syntax
|
|
|
|
|
|
(1.3.6.1.4.1.1466.115.121.1.12) or Name And Optional UID syntax
|
|
|
|
|
|
(1.3.6.1.4.1.1466.115.121.1.34) [RFC2252].
|
|
|
|
|
|
|
|
|
|
|
|
- rangeOfValues means any attribute value which matches the
|
2004-08-28 02:41:02 +08:00
|
|
|
|
specified filter, i.e., for which the specified filter evaluated
|
2003-06-01 06:47:07 +08:00
|
|
|
|
on that attribute value would return TRUE. The filter is not
|
|
|
|
|
|
evaluated on any entries in the DIB, rather it is evaluated
|
|
|
|
|
|
using the semantics defined in 7.8 of [X511], operating on a
|
|
|
|
|
|
fictitious entry that contains only the single attribute value
|
|
|
|
|
|
which is the protected item. Note that the filter is an X.500
|
|
|
|
|
|
search Filter. It has a different syntax from the LDAP search
|
|
|
|
|
|
Filter, but the same semantics.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 13]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
The following items provide constraints that may disable the
|
|
|
|
|
|
granting of certain permissions to protected items in the same
|
|
|
|
|
|
value of ProtectedItems:
|
|
|
|
|
|
|
|
|
|
|
|
- maxValueCount restricts the maximum number of attribute values
|
|
|
|
|
|
allowed for a specified attribute type. It is examined if the
|
|
|
|
|
|
protected item is an attribute value of the specified type and
|
|
|
|
|
|
the permission sought is Add. Values of that attribute in the
|
|
|
|
|
|
entry are counted, without regard to attribute options and
|
|
|
|
|
|
access control, as though the operation which is attempting to
|
|
|
|
|
|
add the values is successful. If the number of values in the
|
|
|
|
|
|
attribute exceeds maxCount, the ACI item is treated as not
|
|
|
|
|
|
granting Add permission.
|
|
|
|
|
|
|
|
|
|
|
|
- maxImmSub restricts the maximum number of immediate subordinates
|
|
|
|
|
|
of the superior entry to an entry being added or imported. It
|
|
|
|
|
|
is examined if the protected item is an entry, the permission
|
|
|
|
|
|
sought is Add or Import, and the immediate superior entry is in
|
|
|
|
|
|
the same server as the entry being added or imported. Immediate
|
|
|
|
|
|
subordinates of the superior entry are counted, without regard
|
|
|
|
|
|
to access control, as though the entry addition or importing is
|
|
|
|
|
|
successful. If the number of subordinates exceeds maxImmSub,
|
|
|
|
|
|
the ACI item is treated as not granting Add or Import
|
|
|
|
|
|
permission.
|
|
|
|
|
|
|
|
|
|
|
|
- restrictedBy restricts values added to the attribute type to
|
|
|
|
|
|
being values that are already present in the same entry as
|
|
|
|
|
|
values of the attribute identified by the valuesIn component.
|
|
|
|
|
|
It is examined if the protected item is an attribute value of
|
|
|
|
|
|
the specified type and the permission sought is Add. Values of
|
|
|
|
|
|
the valuesIn attribute are checked, without regard to attribute
|
|
|
|
|
|
options and access control, as though the operation which adds
|
|
|
|
|
|
the values is successful. If the value to be added is not
|
|
|
|
|
|
present in valuesIn the ACI item is treated as not granting Add
|
|
|
|
|
|
permission.
|
|
|
|
|
|
|
|
|
|
|
|
- contexts is not used in this version of the LDAP profile for
|
|
|
|
|
|
Basic Access Control.
|
|
|
|
|
|
|
|
|
|
|
|
- classes means the contents of entries that have object class
|
|
|
|
|
|
values that satisfy the predicate defined by Refinement (see
|
|
|
|
|
|
[SUBENTRY]).
|
|
|
|
|
|
|
|
|
|
|
|
b) UserClasses defines a set of zero or more users the permissions
|
|
|
|
|
|
apply to. The set of users is selected from the following:
|
|
|
|
|
|
|
|
|
|
|
|
- allUsers means every directory user (with possible requirements
|
|
|
|
|
|
for AuthenticationLevel).
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 14]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
- thisEntry means the user with the same distinguished name as the
|
|
|
|
|
|
entry being accessed.
|
|
|
|
|
|
|
|
|
|
|
|
- name is the set of users with the specified distinguished names
|
|
|
|
|
|
(each with an optional unique identifier).
|
|
|
|
|
|
|
|
|
|
|
|
- userGroup is the set of users who are members of the groups
|
2004-08-28 02:41:02 +08:00
|
|
|
|
(i.e., groupOfNames or groupOfUniqueNames entries [RFC2256])
|
2003-06-01 06:47:07 +08:00
|
|
|
|
identified by the specified distinguished names (each with an
|
|
|
|
|
|
optional unique identifier). Members of a group of unique names
|
|
|
|
|
|
are treated as individual user distinguished names, and not as
|
|
|
|
|
|
the names of other groups of unique names. How group membership
|
|
|
|
|
|
is determined is described in 5.2.5.
|
|
|
|
|
|
|
|
|
|
|
|
- subtree is the set of users whose distinguished names fall
|
|
|
|
|
|
within the scope of the unrefined subtrees (specificationFilter
|
|
|
|
|
|
components SHOULD NOT be used - they SHALL be ignored if
|
|
|
|
|
|
present).
|
|
|
|
|
|
|
|
|
|
|
|
c) SubtreeSpecification is used to specify a subtree relative to the
|
|
|
|
|
|
root DSE, and is not constrained by administrative areas. The
|
|
|
|
|
|
specificationFilter component SHOULD NOT be used. It SHALL be
|
|
|
|
|
|
ignored if present.
|
|
|
|
|
|
|
|
|
|
|
|
A subtree refinement is not allowed because membership in a
|
|
|
|
|
|
subtree whose specification includes only base and/or a
|
|
|
|
|
|
ChopSpecification can be evaluated in isolation, whereas
|
|
|
|
|
|
membership in a subtree definition using specificationFilter can
|
|
|
|
|
|
only be evaluated by obtaining information from the user's entry,
|
|
|
|
|
|
which is potentially in another directory server. Basic Access
|
|
|
|
|
|
Control is designed to avoid remote operations in the course of
|
|
|
|
|
|
making an access control decision.
|
|
|
|
|
|
|
|
|
|
|
|
d) ItemPermission contains a collection of users and their
|
|
|
|
|
|
permissions with respect to ProtectedItems within an itemFirst
|
|
|
|
|
|
specification. The permissions are specified in grantsAndDenials
|
|
|
|
|
|
as discussed in item f). Each of the permissions specified in
|
|
|
|
|
|
grantsAndDenials is considered to have the precedence level
|
|
|
|
|
|
specified in precedence for the purpose of the ACDF. If
|
|
|
|
|
|
precedence is omitted within ItemPermission, then precedence is
|
|
|
|
|
|
taken from the precedence specified for ACIItem.
|
|
|
|
|
|
|
|
|
|
|
|
e) UserPermission contains a collection of protected items and the
|
|
|
|
|
|
associated permissions with respect to userClasses within a
|
|
|
|
|
|
userFirst specification. The associated permissions are specified
|
|
|
|
|
|
in grantsAndDenials as discussed in item f). Each of the
|
|
|
|
|
|
permissions specified in grantsAndDenials is considered to have
|
|
|
|
|
|
the precedence level specified in precedence for the purpose of
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 15]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
the ACDF. If precedence is omitted within UserPermission, the
|
|
|
|
|
|
precedence is taken from the precedence specified for ACIItem.
|
|
|
|
|
|
|
|
|
|
|
|
f) GrantsAndDenials specify the access rights that are granted or
|
|
|
|
|
|
denied by the ACI item.
|
|
|
|
|
|
|
|
|
|
|
|
g) UniqueIdentifier may be used by the authentication mechanism to
|
|
|
|
|
|
distinguish between instances of distinguished name reuse. If
|
|
|
|
|
|
this component is present, then for a requestor's name to match
|
|
|
|
|
|
the UserClasses of an ACIItem that grants permissions, in addition
|
|
|
|
|
|
to the requirement that the requestor's distinguished name match
|
|
|
|
|
|
the specified distinguished name, the authentication of the
|
|
|
|
|
|
requestor shall yield an associated unique identifier, and that
|
|
|
|
|
|
value shall match for equality with the specified value.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.2.5. Determining Group Membership
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Determining whether a given requestor is a group member requires
|
|
|
|
|
|
checking two criteria. The determination may also be constrained if
|
|
|
|
|
|
the group definition is not known locally. The criteria for
|
|
|
|
|
|
membership and the treatment of non-local groups are discussed below.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
a) A directory server is not required to perform a remote operation
|
2003-06-01 06:47:07 +08:00
|
|
|
|
to determine whether the requestor belongs to a particular group
|
|
|
|
|
|
for the purposes of Basic Access Control. If membership in the
|
|
|
|
|
|
group cannot be evaluated, the server shall assume that the
|
|
|
|
|
|
requestor does not belong to the group if the ACI item grants the
|
|
|
|
|
|
permission sought, and does belong to the group if it denies the
|
|
|
|
|
|
permission sought.
|
|
|
|
|
|
|
|
|
|
|
|
Access control administrators should beware of basing access
|
|
|
|
|
|
controls on membership of non-locally available groups or groups
|
|
|
|
|
|
which are available only through replication (and which may,
|
|
|
|
|
|
therefore, be out of date).
|
|
|
|
|
|
|
|
|
|
|
|
b) In order to determine whether the requestor is a member of a
|
|
|
|
|
|
userGroup user class, the following criteria apply:
|
|
|
|
|
|
|
|
|
|
|
|
- The entry named by the userGroup specification is an instance of
|
|
|
|
|
|
the object class groupOfNames or groupOfUniqueNames.
|
|
|
|
|
|
|
|
|
|
|
|
- The name of the requestor is a value of the member or
|
|
|
|
|
|
uniqueMember attribute of that entry.
|
|
|
|
|
|
|
|
|
|
|
|
Values of the member or uniqueMember attribute that do not match
|
|
|
|
|
|
the name of the requestor are ignored, even if they represent the
|
|
|
|
|
|
names of groups of which the originator could be found to be a
|
|
|
|
|
|
member. Hence, nested groups are not supported when evaluating
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 16]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
access controls.
|
|
|
|
|
|
|
|
|
|
|
|
3.3. ACI Operational Attributes
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
ACI is stored as values of operational attributes of entries and
|
|
|
|
|
|
subentries. The operational attributes are multi-valued, which
|
|
|
|
|
|
allows ACI to be represented as a set of ACI items.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.3.1. Prescriptive ACI
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The prescriptiveACI attribute is defined as an operational attribute
|
|
|
|
|
|
of an access control subentry. It contains prescriptive ACI
|
|
|
|
|
|
applicable to entries within that subentry's scope.
|
|
|
|
|
|
|
|
|
|
|
|
The LDAP description [RFC2252] for the prescriptiveACI operational
|
|
|
|
|
|
attribute is:
|
|
|
|
|
|
|
|
|
|
|
|
( 2.5.24.4 NAME 'prescriptiveACI'
|
|
|
|
|
|
EQUALITY directoryStringFirstComponentMatch
|
|
|
|
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
|
|
|
|
|
|
USAGE directoryOperation )
|
|
|
|
|
|
|
|
|
|
|
|
The directoryStringFirstComponentMatch matching rule is described in
|
|
|
|
|
|
[SCHEMA].
|
|
|
|
|
|
|
|
|
|
|
|
Prescriptive ACI within the subentries of a particular administrative
|
|
|
|
|
|
point never applies to the same or any other subentry of that
|
|
|
|
|
|
administrative point, but can be applicable to the subentries of
|
|
|
|
|
|
subordinate administrative points.
|
|
|
|
|
|
|
|
|
|
|
|
Note that prescriptiveACI attributes are not collective attributes.
|
|
|
|
|
|
Although the values of a prescriptiveACI attribute contribute to
|
|
|
|
|
|
access control decisions for each entry within the scope of the
|
|
|
|
|
|
subentry that holds the attribute, the prescriptiveACI attribute does
|
|
|
|
|
|
not appear as part of those entries.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.3.2. Entry ACI
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The entryACI attribute is defined as an operational attribute of an
|
|
|
|
|
|
entry or subentry (not just access control subentries). It contains
|
|
|
|
|
|
entry ACI applicable to the entry or subentry in which it appears,
|
|
|
|
|
|
and that (sub)entry's contents.
|
|
|
|
|
|
|
|
|
|
|
|
The LDAP description [RFC2252] for the entryACI operational attribute
|
|
|
|
|
|
is:
|
|
|
|
|
|
|
|
|
|
|
|
( 2.5.24.5 NAME 'entryACI'
|
|
|
|
|
|
EQUALITY directoryStringFirstComponentMatch
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 17]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
|
|
|
|
|
|
USAGE directoryOperation )
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.3.3. Subentry ACI
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The subentryACI attribute is defined as an operational attribute of
|
|
|
|
|
|
administrative entries [ADMIN] (for any aspect of administration).
|
|
|
|
|
|
It contains subentry ACI that applies to each of the subentries of
|
|
|
|
|
|
the administrative entry in which it appears. Only administrative
|
|
|
|
|
|
entries are permitted to contain a subentryACI attribute.
|
|
|
|
|
|
|
|
|
|
|
|
The LDAP description [RFC2252] for the subentryACI operational
|
|
|
|
|
|
attribute is:
|
|
|
|
|
|
|
|
|
|
|
|
( 2.5.24.6 NAME 'subentryACI'
|
|
|
|
|
|
EQUALITY directoryStringFirstComponentMatch
|
|
|
|
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.1
|
|
|
|
|
|
USAGE directoryOperation )
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.3.4. Protecting the ACI
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
ACI operational attributes are subject to the same protection
|
|
|
|
|
|
mechanisms as other attributes.
|
|
|
|
|
|
|
|
|
|
|
|
The identificationTag provides an identifier for each ACI item. This
|
|
|
|
|
|
tag can be used to remove a specific ACI item value, or to protect it
|
|
|
|
|
|
by prescriptive ACI, entry ACI or subentry ACI. Directory rules
|
|
|
|
|
|
ensure that only one ACI item per access control operational
|
|
|
|
|
|
attribute possesses any specific identificationTag value.
|
|
|
|
|
|
|
|
|
|
|
|
The creation of subentries for an administrative entry may be
|
|
|
|
|
|
controlled by means of the subentryACI operational attribute in the
|
|
|
|
|
|
administrative entry. The right to create prescriptive access
|
|
|
|
|
|
controls may also be governed directly by security policy; this
|
|
|
|
|
|
provision is required to create access controls in new autonomous
|
|
|
|
|
|
administrative areas [ADMIN].
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4. Access Control Decision Points for LDAP Operations
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Each LDAP operation involves making a series of access control
|
|
|
|
|
|
decisions on the various protected items that the operation accesses.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
For some operations (e.g., the Modify operation), each such access
|
2003-06-01 06:47:07 +08:00
|
|
|
|
control decision must grant access for the operation to succeed; if
|
|
|
|
|
|
access is denied to any protected item, the whole operation fails.
|
2004-08-28 02:41:02 +08:00
|
|
|
|
For other operations (e.g., the Search operation), protected items to
|
2003-06-01 06:47:07 +08:00
|
|
|
|
which access is denied are simply omitted from the operation result
|
|
|
|
|
|
and processing continues.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 18]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
If the requested access is denied, further access control decisions
|
|
|
|
|
|
may be needed to determine if the user has DiscloseOnError
|
|
|
|
|
|
permissions to the protected item. Only if DiscloseOnError
|
|
|
|
|
|
permission is granted may the server respond with an error that
|
|
|
|
|
|
reveals the existence of the protected item. In all other cases, the
|
|
|
|
|
|
server MUST act so as to conceal the existence of the protected item.
|
|
|
|
|
|
|
|
|
|
|
|
The permissions required to access each protected item, are specified
|
|
|
|
|
|
for each operation in the following sections. The algorithm by which
|
|
|
|
|
|
a permission is determined to be granted or not granted is specified
|
2004-08-28 02:41:02 +08:00
|
|
|
|
in Section 3.5.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.1. Common Elements of Procedure
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
This section defines the elements of procedure that are common to all
|
|
|
|
|
|
LDAP operations when Basic Access Control is in effect.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.1.1. Alias Dereferencing
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
If, in the process of locating a target object entry (nominated in an
|
|
|
|
|
|
LDAP request), alias dereferencing is required, no specific
|
|
|
|
|
|
permissions are necessary for alias dereferencing to take place.
|
|
|
|
|
|
However, if alias dereferencing would result in a referral being
|
|
|
|
|
|
returned, the following sequence of access controls applies.
|
|
|
|
|
|
|
|
|
|
|
|
1) Read permission is required to the alias entry. If permission is
|
|
|
|
|
|
not granted, the operation fails in accordance to the procedure
|
|
|
|
|
|
described in 5.4.1.3.
|
|
|
|
|
|
|
|
|
|
|
|
2) Read permission is required to the aliasedEntryName attribute and
|
|
|
|
|
|
to the single value that it contains. If permission is not
|
|
|
|
|
|
granted, the operation fails and the resultCode
|
|
|
|
|
|
aliasDereferencingProblem SHALL be returned. The matchedDN field
|
|
|
|
|
|
of the LDAPResult SHALL contain the name of the alias entry.
|
|
|
|
|
|
|
|
|
|
|
|
In addition to the access controls described above, security policy
|
|
|
|
|
|
may prevent the disclosure of knowledge of other servers which would
|
|
|
|
|
|
otherwise be conveyed in a referral. If such a policy is in effect
|
|
|
|
|
|
the resultCode insufficientAccessRights SHALL be returned.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.1.2. Return of Names in Errors
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Certain LDAP result codes, i.e., noSuchObject, aliasProblem,
|
2003-06-01 06:47:07 +08:00
|
|
|
|
invalidDNSyntax and aliasDereferencingProblem, provide the name of an
|
|
|
|
|
|
entry in the matchedDN field of an LDAPResult. The DN of an entry
|
|
|
|
|
|
SHALL only be provided in the matchedDN field if DiscloseOnError
|
|
|
|
|
|
permission is granted to that entry, otherwise, the matchedDN field
|
|
|
|
|
|
of the LDAPResult SHALL either contain the name of the next superior
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 19]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
entry to which DiscloseOnError permission is granted, or, if
|
|
|
|
|
|
DiscloseOnError permission is not granted to any superior entry, the
|
|
|
|
|
|
name of the root DSE (i.e., a zero-length LDAPDN).
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.1.3. Non-disclosure of Entry Existence
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
If, while performing an LDAP operation, the necessary entry level
|
|
|
|
|
|
permission is not granted to the specified target object entry -
|
|
|
|
|
|
e.g., the entry to be modified - the operation fails; if
|
|
|
|
|
|
DiscloseOnError permission is granted to the target entry, the
|
|
|
|
|
|
resultCode insufficientAccessRights SHALL be returned, otherwise, the
|
|
|
|
|
|
resultCode noSuchObject SHALL be returned. The matchedDN field of
|
|
|
|
|
|
the LDAPResult SHALL either contain the name of the next superior
|
|
|
|
|
|
entry to which DiscloseOnError permission is granted, or, if
|
|
|
|
|
|
DiscloseOnError permission is not granted to any superior entry, the
|
|
|
|
|
|
name of the root DSE (i.e., a zero-length LDAPDN).
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Additionally, whenever the server detects an operational error
|
|
|
|
|
|
(including a referral resultCode), it shall ensure that in returning
|
|
|
|
|
|
that error it does not compromise the existence of the named target
|
|
|
|
|
|
entry and any of its superiors. For example, before returning a
|
|
|
|
|
|
resultCode of timeLimitExceeded or notAllowedOnNonLeaf, the server
|
|
|
|
|
|
verifies that DiscloseOnError permission is granted to the target
|
|
|
|
|
|
entry. If it is not, the procedure described in the paragraph above
|
|
|
|
|
|
SHALL be followed.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.2. Compare Operation Decision Points
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The following sequence of access controls applies for an entry being
|
|
|
|
|
|
compared.
|
|
|
|
|
|
|
|
|
|
|
|
1) Read permission for the entry to be compared is required. If
|
|
|
|
|
|
permission is not granted, the operation fails in accordance with
|
|
|
|
|
|
5.4.1.3.
|
|
|
|
|
|
|
|
|
|
|
|
2) Compare permission for the attribute to be compared is required.
|
|
|
|
|
|
If permission is not granted, the operation fails: if
|
|
|
|
|
|
DiscloseOnError permission is granted to the attribute being
|
|
|
|
|
|
compared, a resultCode of insufficientAccessRight SHALL be
|
|
|
|
|
|
returned, otherwise, the resultCode noSuchAttribute SHALL be
|
|
|
|
|
|
returned.
|
|
|
|
|
|
|
|
|
|
|
|
3) If there exists a value within the attribute being compared that
|
|
|
|
|
|
matches the purported argument and for which Compare permission is
|
|
|
|
|
|
granted, the operation returns the resultCode compareTrue,
|
|
|
|
|
|
otherwise the operation returns the resultCode compareFalse.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.3. Search Operation Decision Points
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 20]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The following sequence of access controls applies for a portion of
|
|
|
|
|
|
the DIT being searched.
|
|
|
|
|
|
|
|
|
|
|
|
1) No specific permission is required to the entry identified by the
|
|
|
|
|
|
baseObject argument in order to initiate a search. However, if
|
2004-08-28 02:41:02 +08:00
|
|
|
|
the baseObject is within the scope of the SearchArgument (i.e.,
|
2003-06-01 06:47:07 +08:00
|
|
|
|
when the subset argument specifies baseObject or wholeSubtree) the
|
|
|
|
|
|
access controls specified in 2) through 5) will apply.
|
|
|
|
|
|
|
|
|
|
|
|
2) Browse or Read permission is required for the single entry within
|
|
|
|
|
|
the scope of a baseObject search. An entry for which neither of
|
|
|
|
|
|
these permissions is granted is ignored.
|
|
|
|
|
|
|
|
|
|
|
|
This differs from the X.500 DAP Search operation where the Browse
|
|
|
|
|
|
permission alone is required. An entry with Read permission but
|
|
|
|
|
|
not Browse permission cannot be searched but can still be examined
|
|
|
|
|
|
with an X.500 DAP Read operation. LDAP relies on baseObject
|
|
|
|
|
|
search operations to provide the functionality of the DAP Read
|
|
|
|
|
|
operation. Accepting Read permission for the target entry in a
|
|
|
|
|
|
baseObject search gives an LDAP baseObject search the same access
|
|
|
|
|
|
rights to the entry as the DAP Read operation.
|
|
|
|
|
|
|
|
|
|
|
|
3) Browse permission is required for an entry within the scope of a
|
|
|
|
|
|
singleLevel or wholeSubtree search to be a candidate for
|
|
|
|
|
|
consideration. Entries for which this permission is not granted
|
|
|
|
|
|
are ignored.
|
|
|
|
|
|
|
|
|
|
|
|
4) The filter argument is applied to each entry left to be considered
|
|
|
|
|
|
after taking 2) and 3) into account, in accordance with the
|
|
|
|
|
|
following:
|
|
|
|
|
|
|
|
|
|
|
|
a) For a present Filter item, if there exists an attribute value
|
|
|
|
|
|
such that the attribute type of the value (possibly a subtype
|
|
|
|
|
|
of the attribute type in the FilterItem) satisfies the Filter
|
|
|
|
|
|
item and FilterMatch permission is granted for the value and
|
|
|
|
|
|
for the attribute type then the FilterItem evaluates to TRUE,
|
|
|
|
|
|
otherwise, it evaluates to FALSE.
|
|
|
|
|
|
|
|
|
|
|
|
If a directory server does not support True/False filters
|
|
|
|
|
|
[FILTER] on LDAP searches, or if directory clients do not
|
|
|
|
|
|
exploit this capability, then access control administrators
|
|
|
|
|
|
SHOULD grant FilterMatch permission for the objectClass
|
|
|
|
|
|
attribute over entries where Read permission is also granted so
|
|
|
|
|
|
that an LDAP baseObject search with a filter testing for the
|
|
|
|
|
|
presence of the objectClass attribute will have the same access
|
|
|
|
|
|
rights to the target entry as the DAP Read operation. An LDAP
|
|
|
|
|
|
baseObject search with a True filter does not require
|
|
|
|
|
|
FilterMatch permission for any particular attribute type.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 21]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
b) For an equalityMatch, substrings, greaterOrEqual, lessOrEqual,
|
|
|
|
|
|
approxMatch or extensibleMatch Filter item, if there exists an
|
|
|
|
|
|
attribute value such that the value satisfies the Filter item
|
|
|
|
|
|
and FilterMatch permission is granted for the value and for its
|
|
|
|
|
|
attribute type (possibly a subtype of the attribute type in the
|
|
|
|
|
|
FilterItem) then the FilterItem evaluates to TRUE, otherwise,
|
|
|
|
|
|
it evaluates to FALSE.
|
|
|
|
|
|
|
|
|
|
|
|
Once the access controls defined in 2) through 4) have been applied,
|
|
|
|
|
|
an entry is either selected or discarded.
|
|
|
|
|
|
|
|
|
|
|
|
5) For each selected entry the information returned is as follows:
|
|
|
|
|
|
|
|
|
|
|
|
a) ReturnDN permission for an entry is required in order to return
|
|
|
|
|
|
its distinguished name in a SearchResultEntry response. If
|
|
|
|
|
|
this permission is not granted, the server SHALL either, return
|
|
|
|
|
|
the name of a valid alias to the entry, or, omit the entry from
|
|
|
|
|
|
the search result.
|
|
|
|
|
|
|
|
|
|
|
|
If the base entry of the search was located using an alias,
|
|
|
|
|
|
then that alias is known to be a valid alias. Otherwise, how
|
|
|
|
|
|
it is ensured that the alias is valid is outside the scope of
|
|
|
|
|
|
this specification.
|
|
|
|
|
|
|
|
|
|
|
|
Where a server has a choice of alias names available to it for
|
|
|
|
|
|
return, it is RECOMMENDED that where possible it choose the
|
|
|
|
|
|
same alias name for repeated requests by the same client, in
|
|
|
|
|
|
order to provide a consistent service.
|
|
|
|
|
|
|
|
|
|
|
|
b) If the typesOnly field of the SearchRequest is TRUE then, for
|
|
|
|
|
|
each attribute type that is to be returned, Read permission for
|
|
|
|
|
|
the attribute type and Read permission for at least one value
|
|
|
|
|
|
of the attribute is required. If permission is not granted,
|
|
|
|
|
|
the attribute type is omitted from the attribute list in the
|
|
|
|
|
|
SearchResultEntry. If as a consequence of applying these
|
|
|
|
|
|
controls no attribute type information is selected, the
|
|
|
|
|
|
SearchResultEntry is returned but no attribute type information
|
2004-08-28 02:41:02 +08:00
|
|
|
|
is conveyed with it (i.e., the attribute list is empty).
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
c) If the typesOnly field of the SearchRequest is FALSE then Read
|
|
|
|
|
|
permission is required for each attribute type and for each
|
|
|
|
|
|
attribute value that is to be returned. If permission to an
|
|
|
|
|
|
attribute type is not granted, the attribute is omitted from
|
|
|
|
|
|
the SearchResultEntry. If permission to an attribute value is
|
|
|
|
|
|
not granted, the value is omitted from its corresponding
|
|
|
|
|
|
attribute. If all values of an attribute are omitted then the
|
|
|
|
|
|
attribute type is omitted from the attribute list in the
|
|
|
|
|
|
SearchResultEntry. If as a consequence of applying these
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 22]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
controls no attribute information is selected, the
|
|
|
|
|
|
SearchResultEntry is returned but no attribute information is
|
2004-08-28 02:41:02 +08:00
|
|
|
|
conveyed with it (i.e., the attribute list is empty).
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
6) If as a consequence of applying the above controls to the entire
|
|
|
|
|
|
scoped subtree the search result contains no entries (excluding
|
|
|
|
|
|
any SearchResultReferences) and if DiscloseOnError permission is
|
|
|
|
|
|
not granted to the entry identified by the baseObject argument,
|
|
|
|
|
|
the operation fails and the resultCode noSuchObject SHALL be
|
|
|
|
|
|
returned. The matchedDN field of the LDAPResult SHALL either
|
|
|
|
|
|
contain the name of the next superior entry to which
|
|
|
|
|
|
DiscloseOnError permission is granted, or the name of the root DSE
|
2004-08-28 02:41:02 +08:00
|
|
|
|
(i.e., a zero-length LDAPDN). Otherwise, the operation succeeds
|
2003-06-01 06:47:07 +08:00
|
|
|
|
but no subordinate information is conveyed with it.
|
|
|
|
|
|
|
|
|
|
|
|
Security policy may prevent the disclosure of knowledge of other
|
|
|
|
|
|
servers which would otherwise be conveyed as SearchResultReferences.
|
|
|
|
|
|
If such a policy is in effect SearchResultReferences are omitted from
|
|
|
|
|
|
the search result.
|
|
|
|
|
|
|
|
|
|
|
|
No specific permissions are necessary to allow alias dereferencing to
|
|
|
|
|
|
take place in the course of a search operation. However, for each
|
|
|
|
|
|
alias entry encountered, if alias dereferencing would result in a
|
|
|
|
|
|
SearchResultReference being returned, the following access controls
|
|
|
|
|
|
apply: Read permission is required to the alias entry, the
|
|
|
|
|
|
aliasedEntryName attribute and to the single value that it contains.
|
|
|
|
|
|
If any of these permissions is not granted, the SearchResultReference
|
|
|
|
|
|
SHALL be omitted from the search result.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.4. Add Operation Decision Points
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The following sequence of access controls apply for an entry being
|
|
|
|
|
|
added.
|
|
|
|
|
|
|
|
|
|
|
|
1) No specific permission is required for the immediate superior of
|
|
|
|
|
|
the entry identified by the entry field of the AddRequest.
|
|
|
|
|
|
|
|
|
|
|
|
2) If an entry already exists with a distinguished name equal to the
|
|
|
|
|
|
entry field the operation fails; if DiscloseOnError or Add
|
|
|
|
|
|
permission is granted to the existing entry, the resultCode
|
|
|
|
|
|
entryAlreadyExists SHALL be returned, otherwise, the procedure
|
|
|
|
|
|
described in 5.4.1.3 is followed with respect to the entry being
|
|
|
|
|
|
added.
|
|
|
|
|
|
|
|
|
|
|
|
3) Add permission is required for the new entry being added. If this
|
|
|
|
|
|
permission is not granted, the operation fails; the procedure
|
|
|
|
|
|
described in 5.4.1.3 is followed with respect to the entry being
|
|
|
|
|
|
added.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 23]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
The Add permission is provided as prescriptive ACI when attempting
|
|
|
|
|
|
to add an entry and as prescriptive ACI or subentry ACI when
|
|
|
|
|
|
attempting to add a subentry. Any values of the entryACI
|
|
|
|
|
|
attribute in the entry being added SHALL be ignored.
|
|
|
|
|
|
|
|
|
|
|
|
4) Add permission is required for each attribute type and for each
|
|
|
|
|
|
value that is to be added. If any permission is absent, the
|
|
|
|
|
|
operation fails and the resultCode insufficientAccessRights SHALL
|
|
|
|
|
|
be returned.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.5. Delete Operation Decision Points
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The following sequence of access controls apply for an entry being
|
|
|
|
|
|
removed.
|
|
|
|
|
|
|
|
|
|
|
|
1) Remove permission is required for the entry being removed. If
|
|
|
|
|
|
this permission is not granted, the operation fails in accordance
|
|
|
|
|
|
with 5.4.1.3.
|
|
|
|
|
|
|
|
|
|
|
|
2) No specific permissions are required for any of the attributes and
|
|
|
|
|
|
attribute values present within the entry being removed.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.6. Modify Operation Decision Points
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The following sequence of access controls apply for an entry being
|
|
|
|
|
|
modified.
|
|
|
|
|
|
|
|
|
|
|
|
1) Modify permission is required for the entry being modified. If
|
|
|
|
|
|
this permission is not granted, the operation fails in accordance
|
|
|
|
|
|
with 5.4.1.3.
|
|
|
|
|
|
|
|
|
|
|
|
2) For each of the specified modification arguments applied in
|
|
|
|
|
|
sequence, the following permissions are required:
|
|
|
|
|
|
|
|
|
|
|
|
a) Add permission is required for each of the attribute values
|
|
|
|
|
|
specified in an add modification. If the attribute does not
|
|
|
|
|
|
currently exist then Add permission for the attribute type is
|
|
|
|
|
|
also required. If these permissions are not granted, or any of
|
|
|
|
|
|
the attribute values already exist, the operation fails; if an
|
|
|
|
|
|
attribute value already exists and DiscloseOnError or Add is
|
|
|
|
|
|
granted to that attribute value, the resultCode
|
|
|
|
|
|
attributeOrValueExists SHALL be returned, otherwise, the
|
|
|
|
|
|
resultCode insufficientAccessRights SHALL be returned.
|
|
|
|
|
|
|
|
|
|
|
|
b) Remove permission is required for the attribute type specified
|
|
|
|
|
|
in a delete modification with no listed attribute values. If
|
|
|
|
|
|
this permission is not granted, the operation fails; if
|
|
|
|
|
|
DiscloseOnError permission is granted to the attribute being
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 24]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
removed and the attribute exists, the resultCode
|
2003-06-01 06:47:07 +08:00
|
|
|
|
insufficientAccessRights SHALL be returned, otherwise, the
|
|
|
|
|
|
resultCode noSuchAttribute SHALL be returned.
|
|
|
|
|
|
|
|
|
|
|
|
No specific permissions are required for any of the attribute
|
|
|
|
|
|
values present within the attribute being removed.
|
|
|
|
|
|
|
|
|
|
|
|
c) Remove permission is required for each of the values in a
|
|
|
|
|
|
delete modification with listed attribute values. If all
|
|
|
|
|
|
current values of the attribute are specified to be removed
|
|
|
|
|
|
(which causes the attribute itself to be removed), then Remove
|
|
|
|
|
|
permission for the attribute type is also required. If these
|
|
|
|
|
|
permissions are not granted, the operation fails; if
|
|
|
|
|
|
DiscloseOnError permission is granted to any of the attribute
|
|
|
|
|
|
values being removed, the resultCode insufficientAccessRights
|
|
|
|
|
|
SHALL be returned, otherwise, the resultCode noSuchAttribute
|
|
|
|
|
|
SHALL be returned.
|
|
|
|
|
|
|
|
|
|
|
|
d) Remove and Add permission is required for the attribute type,
|
|
|
|
|
|
and Add permission is required for each of the specified
|
|
|
|
|
|
attribute values, in a replace modification. If these
|
|
|
|
|
|
permissions are not granted the operation fails and the
|
|
|
|
|
|
resultCode insufficientAccessRights SHALL be returned.
|
|
|
|
|
|
|
|
|
|
|
|
No specific permissions are required to remove any existing
|
|
|
|
|
|
attribute values of the attribute being replaced.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.4.7. Modify DN Operation Decision Points
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The following sequence of access controls apply for an entry having
|
|
|
|
|
|
its DN modified.
|
|
|
|
|
|
|
|
|
|
|
|
1) If the effect of the operation is to change the RDN of the entry
|
|
|
|
|
|
then Rename permission (determined with respect to its original
|
|
|
|
|
|
name) is required for the entry. If this permission is not
|
|
|
|
|
|
granted, the operation fails; the procedure described in 5.4.1.3
|
|
|
|
|
|
is followed with respect to the entry being renamed (considered
|
|
|
|
|
|
with its original name).
|
|
|
|
|
|
|
|
|
|
|
|
No additional permissions are required even if, as a result of
|
|
|
|
|
|
modifying the RDN of the entry, a new distinguished value needs to
|
|
|
|
|
|
be added, or an old one removed. No specific permissions are
|
|
|
|
|
|
required for the subordinates of the renamed entry.
|
|
|
|
|
|
|
|
|
|
|
|
2) If the effect of the operation is to move an entry to a new
|
|
|
|
|
|
superior in the DIT then Export permission (determined with
|
|
|
|
|
|
respect to its original name) and Import permission (determined
|
|
|
|
|
|
with respect to its new name) are required for the entry. If
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 25]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
either of these permissions is not granted, the operation fails;
|
|
|
|
|
|
the procedure described in 5.4.1.3 is followed with respect to the
|
|
|
|
|
|
entry being moved (considered with its original name).
|
|
|
|
|
|
|
|
|
|
|
|
The Import permission is provided as prescriptive ACI when
|
|
|
|
|
|
attempting to move an entry and as prescriptive ACI or subentry
|
|
|
|
|
|
ACI when attempting to move a subentry. Any values of the
|
|
|
|
|
|
entryACI attribute in the entry or subentry being moved SHALL be
|
|
|
|
|
|
ignored.
|
|
|
|
|
|
|
|
|
|
|
|
No specific permissions are required for the subordinates of the
|
|
|
|
|
|
moved entry.
|
|
|
|
|
|
|
|
|
|
|
|
Note that a single Modify DN Operation may simultaneously rename and
|
|
|
|
|
|
move an entry.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.5. Access Control Decision Function
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
This section describes how ACI items are processed in order to decide
|
|
|
|
|
|
whether to grant or deny a particular requestor a specified
|
|
|
|
|
|
permission to a given protected item.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Section 3.5.1 describes the inputs to the ACDF. Sections 3.5.2
|
|
|
|
|
|
through 3.5.4 describe the steps in the ACDF. The output is a
|
2003-06-01 06:47:07 +08:00
|
|
|
|
decision to grant or deny access to the protected item.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.5.1. Inputs
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
For each invocation of the ACDF, the inputs are:
|
|
|
|
|
|
|
|
|
|
|
|
a) the requestor's Distinguished Name, unique identifier, and
|
|
|
|
|
|
authentication level, or as many of these as are available;
|
|
|
|
|
|
|
|
|
|
|
|
b) the protected item (an entry, an attribute, or an attribute value)
|
|
|
|
|
|
being considered at the current decision point for which the ACDF
|
|
|
|
|
|
was invoked;
|
|
|
|
|
|
|
|
|
|
|
|
c) the requested permission specified for the current decision point;
|
|
|
|
|
|
|
|
|
|
|
|
d) the ACI items applicable to the entry containing (or which is) the
|
|
|
|
|
|
protected item.
|
|
|
|
|
|
|
|
|
|
|
|
In addition, if the ACI items include any of the protected item
|
|
|
|
|
|
constraints described in 5.2.1.4, the whole entry and the number of
|
|
|
|
|
|
immediate subordinates of its superior entry may also be required as
|
|
|
|
|
|
inputs.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.5.2. Tuples
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 26]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
For each ACI item, expand the item into a set of tuples, one tuple
|
|
|
|
|
|
for each element of the itemPermissions and userPermissions sets,
|
|
|
|
|
|
containing the following elements:
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
( userClasses, authenticationLevel, protectedItems,
|
|
|
|
|
|
grantsAndDenials, precedence )
|
|
|
|
|
|
|
|
|
|
|
|
Collect all tuples from all ACI items into a single set.
|
|
|
|
|
|
|
|
|
|
|
|
For any tuple whose grantsAndDenials specify both grants and denials,
|
|
|
|
|
|
replace the tuple with two tuples - one specifying only grants and
|
|
|
|
|
|
the other specifying only denials.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.5.3. Discarding Irrelevant Tuples
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Perform the following steps to discard all irrelevant tuples:
|
|
|
|
|
|
|
|
|
|
|
|
1) Discard all tuples that do not include the requestor in the
|
|
|
|
|
|
tuple's userClasses as follows:
|
|
|
|
|
|
|
|
|
|
|
|
a) For tuples that grant access, discard all tuples that do not
|
|
|
|
|
|
include the requestor's identity in the tuples's userClasses
|
|
|
|
|
|
element, taking into account UniqueIdentifier elements if
|
|
|
|
|
|
relevant. Where a tuple's userClasses specifies a
|
|
|
|
|
|
UniqueIdentifier, a matching value shall be present in the
|
|
|
|
|
|
requestor's identity if the tuple is not to be discarded.
|
|
|
|
|
|
Discard tuples that specify an authentication level higher than
|
|
|
|
|
|
that associated with the requestor.
|
|
|
|
|
|
|
|
|
|
|
|
b) For tuples that deny access, retain all tuples that include the
|
|
|
|
|
|
requestor in the tuple's userClasses element, taking into
|
|
|
|
|
|
account uniqueIdentifier elements if relevant. Also retain all
|
|
|
|
|
|
tuples that deny access and which specify an authentication
|
|
|
|
|
|
level higher than that associated with the requestor. This
|
|
|
|
|
|
reflects the fact that the requestor has not adequately proved
|
|
|
|
|
|
non-membership in the user class for which the denial is
|
|
|
|
|
|
specified. All other tuples that deny access are discarded.
|
|
|
|
|
|
|
|
|
|
|
|
2) Discard all tuples that do not include the protected item in
|
|
|
|
|
|
protectedItems.
|
|
|
|
|
|
|
|
|
|
|
|
3) Examine all tuples that include maxValueCount, maxImmSub or
|
|
|
|
|
|
restrictedBy. Discard all such tuples which grant access and
|
|
|
|
|
|
which do not satisfy any of these constraints.
|
|
|
|
|
|
|
|
|
|
|
|
4) Discard all tuples that do not include the requested permission as
|
|
|
|
|
|
one of the set bits in grantsAndDenials.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 27]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
The order in which tuples are discarded does not change the output of
|
|
|
|
|
|
the ACDF.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
3.5.4. Highest Precedence and Specificity
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Perform the following steps to select those tuples of highest
|
|
|
|
|
|
precedence and specificity:
|
|
|
|
|
|
|
|
|
|
|
|
1) Discard all tuples having a precedence less than the highest
|
|
|
|
|
|
precedence among the remaining tuples.
|
|
|
|
|
|
|
|
|
|
|
|
2) If more than one tuple remains, choose the tuples with the most
|
|
|
|
|
|
specific user class. If there are any tuples matching the
|
|
|
|
|
|
requestor with UserClasses element name or thisEntry, discard all
|
|
|
|
|
|
other tuples. Otherwise if there are any tuples matching
|
|
|
|
|
|
UserGroup, discard all other tuples. Otherwise if there are any
|
|
|
|
|
|
tuples matching subtree, discard all other tuples.
|
|
|
|
|
|
|
|
|
|
|
|
3) If more than one tuple remains, choose the tuples with the most
|
|
|
|
|
|
specific protected item. If the protected item is an attribute
|
|
|
|
|
|
and there are tuples that specify the attribute type explicitly,
|
|
|
|
|
|
discard all other tuples. If the protected item is an attribute
|
|
|
|
|
|
value, and there are tuples that specify the attribute value
|
|
|
|
|
|
explicitly, discard all other tuples. A protected item which is a
|
|
|
|
|
|
rangeOfValues is to be treated as specifying an attribute value
|
|
|
|
|
|
explicitly.
|
|
|
|
|
|
|
|
|
|
|
|
Grant access if and only if one or more tuples remain and all grant
|
|
|
|
|
|
access. Otherwise deny access.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
4. Simplified Access Control
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
This section describes the functionality of the Simplified Access
|
|
|
|
|
|
Control scheme. It provides a subset of the functionality found in
|
|
|
|
|
|
Basic Access Control.
|
|
|
|
|
|
|
|
|
|
|
|
When Simplified Access Control is used, the accessControlScheme
|
|
|
|
|
|
operational attribute [ACA] SHALL have the value
|
|
|
|
|
|
simplified-access-control (2.5.28.2).
|
|
|
|
|
|
|
|
|
|
|
|
The functionality of Simplified Access Control is the same as Basic
|
|
|
|
|
|
Access Control except that:
|
|
|
|
|
|
|
|
|
|
|
|
1) Access control decisions shall be made only on the basis of values
|
|
|
|
|
|
of prescriptiveACI and subentryACI operational attributes. Values
|
|
|
|
|
|
of the entryACI attribute, if present, SHALL NOT be used to make
|
|
|
|
|
|
access control decisions.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 28]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
2) Access Control Inner Areas are not used. Values of
|
|
|
|
|
|
prescriptiveACI attributes appearing in subentries of ACIPs SHALL
|
2003-06-01 06:47:07 +08:00
|
|
|
|
NOT be used to make access control decisions.
|
|
|
|
|
|
|
|
|
|
|
|
All other provisions SHALL be as defined for Basic Access Control.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
5. Security Considerations
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
Access control administrators should beware of basing access controls
|
|
|
|
|
|
on membership of non-locally available groups or groups which are
|
|
|
|
|
|
available only through replication (and which may, therefore, be out
|
|
|
|
|
|
of date).
|
|
|
|
|
|
|
|
|
|
|
|
A particular DSA might not have the ACI governing any data that it
|
|
|
|
|
|
caches. Administrators should be aware that a directory server with
|
|
|
|
|
|
the capability of caching may pose a significant security risk to
|
|
|
|
|
|
other directory servers, in that it may reveal information to
|
|
|
|
|
|
unauthorized users.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
6. Acknowledgements
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
This document is derived from, and duplicates substantial portions
|
2004-08-28 02:41:02 +08:00
|
|
|
|
of, Section 8 of X.501 [X501], and selected extracts from X.511
|
|
|
|
|
|
[X511].
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
7. IANA Considerations
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The Internet Assigned Numbers Authority (IANA) is requested to update
|
2004-08-28 02:41:02 +08:00
|
|
|
|
the LDAP descriptors registry [BCP64] as indicated by the following
|
2003-06-01 06:47:07 +08:00
|
|
|
|
templates:
|
|
|
|
|
|
|
|
|
|
|
|
Subject: Request for LDAP Descriptor Registration
|
|
|
|
|
|
Descriptor (short name): basic-access-control
|
|
|
|
|
|
Object Identifier: 2.5.28.1
|
|
|
|
|
|
Person & email address to contact for further information:
|
|
|
|
|
|
Steven Legg <steven.legg@adacel.com.au>
|
|
|
|
|
|
Usage: other (access control scheme)
|
|
|
|
|
|
Specification: RFC XXXX
|
|
|
|
|
|
Author/Change Controller: IESG
|
|
|
|
|
|
|
|
|
|
|
|
Subject: Request for LDAP Descriptor Registration
|
|
|
|
|
|
Descriptor (short name): simplified-access-control
|
|
|
|
|
|
Object Identifier: 2.5.28.2
|
|
|
|
|
|
Person & email address to contact for further information:
|
|
|
|
|
|
Steven Legg <steven.legg@adacel.com.au>
|
|
|
|
|
|
Usage: other (access control scheme)
|
|
|
|
|
|
Specification: RFC XXXX
|
|
|
|
|
|
Author/Change Controller: IESG
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 29]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Subject: Request for LDAP Descriptor Registration
|
|
|
|
|
|
Descriptor (short name): prescriptiveACI
|
|
|
|
|
|
Object Identifier: 2.5.24.4
|
|
|
|
|
|
Person & email address to contact for further information:
|
|
|
|
|
|
Steven Legg <steven.legg@adacel.com.au>
|
|
|
|
|
|
Usage: attribute type
|
|
|
|
|
|
Specification: RFC XXXX
|
|
|
|
|
|
Author/Change Controller: IESG
|
|
|
|
|
|
|
|
|
|
|
|
Subject: Request for LDAP Descriptor Registration
|
|
|
|
|
|
Descriptor (short name): entryACI
|
|
|
|
|
|
Object Identifier: 2.5.24.5
|
|
|
|
|
|
Person & email address to contact for further information:
|
|
|
|
|
|
Steven Legg <steven.legg@adacel.com.au>
|
|
|
|
|
|
Usage: attribute type
|
|
|
|
|
|
Specification: RFC XXXX
|
|
|
|
|
|
Author/Change Controller: IESG
|
|
|
|
|
|
|
|
|
|
|
|
Subject: Request for LDAP Descriptor Registration
|
|
|
|
|
|
Descriptor (short name): subentryACI
|
|
|
|
|
|
Object Identifier: 2.5.24.6
|
|
|
|
|
|
Person & email address to contact for further information:
|
|
|
|
|
|
Steven Legg <steven.legg@adacel.com.au>
|
|
|
|
|
|
Usage: attribute type
|
|
|
|
|
|
Specification: RFC XXXX
|
|
|
|
|
|
Author/Change Controller: IESG
|
|
|
|
|
|
|
|
|
|
|
|
Appendix A. LDAP Specific Encoding for the ACI Item Syntax
|
|
|
|
|
|
|
|
|
|
|
|
This appendix is non-normative.
|
|
|
|
|
|
|
|
|
|
|
|
The LDAP-specific encoding for the ACI Item syntax is specified by
|
2004-08-28 02:41:02 +08:00
|
|
|
|
the Generic String Encoding Rules [GSER]. The ABNF [RFC2234] in this
|
|
|
|
|
|
appendix for this syntax is provided only as a convenience and is
|
|
|
|
|
|
equivalent to the encoding specified by the application of GSER.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
Since the ACI Item ASN.1 type may be extended in future editions of
|
2004-08-28 02:41:02 +08:00
|
|
|
|
X.501 [X501], the provided ABNF should be regarded as a snapshot in
|
|
|
|
|
|
time. The LDAP-specific encoding for any extension to the ACI Item
|
|
|
|
|
|
ASN.1 type can be determined from the rules of GSER.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
In the event that there is a discrepancy between this ABNF and the
|
2004-08-28 02:41:02 +08:00
|
|
|
|
encoding determined by GSER, then GSER is to be taken as definitive.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
ACIItem = "{" sp aci-identificationTag ","
|
|
|
|
|
|
sp aci-precedence ","
|
|
|
|
|
|
sp aci-authenticationLevel ","
|
|
|
|
|
|
sp aci-itemOrUserFirst
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 30]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
aci-identificationTag = id-identificationTag msp
|
|
|
|
|
|
DirectoryString
|
|
|
|
|
|
aci-precedence = id-precedence msp Precedence
|
|
|
|
|
|
aci-authenticationLevel = id-authenticationLevel msp
|
|
|
|
|
|
AuthenticationLevel
|
|
|
|
|
|
aci-itemOrUserFirst = id-itemOrUserFirst msp
|
|
|
|
|
|
ItemOrUserFirst
|
|
|
|
|
|
id-identificationTag = %x69.64.65.6E.74.69.66.69.63.61.74.69.6F
|
|
|
|
|
|
%x6E.54.61.67 ; "identificationTag"
|
|
|
|
|
|
id-precedence = %x70.72.65.63.65.64.65.6E.63.65
|
|
|
|
|
|
; "precedence"
|
|
|
|
|
|
id-authenticationLevel = %x61.75.74.68.65.6E.74.69.63.61.74.69.6F
|
|
|
|
|
|
%x6E.4C.65.76.65.6C
|
|
|
|
|
|
; "authenticationLevel"
|
|
|
|
|
|
id-itemOrUserFirst = %x69.74.65.6D.4F.72.55.73.65.72.46.69.72
|
|
|
|
|
|
%x73.74 ; "itemOrUserFirst"
|
|
|
|
|
|
|
|
|
|
|
|
Precedence = INTEGER-0-MAX ; MUST be less than 256
|
|
|
|
|
|
|
|
|
|
|
|
AuthenticationLevel = al-basicLevels / al-other
|
|
|
|
|
|
al-basicLevels = id-basicLevels ":" BasicLevels
|
|
|
|
|
|
al-other = id-other ":" EXTERNAL
|
|
|
|
|
|
id-basicLevels = %x62.61.73.69.63.4C.65.76.65.6C.73
|
|
|
|
|
|
; "basicLevels"
|
|
|
|
|
|
id-other = %x6F.74.68.65.72 ; "other"
|
|
|
|
|
|
|
|
|
|
|
|
BasicLevels = "{" sp bl-level
|
|
|
|
|
|
[ "," sp bl-localQualifier ]
|
|
|
|
|
|
[ "," sp bl-signed ]
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
bl-level = id-level msp Level
|
|
|
|
|
|
bl-localQualifier = id-localQualifier msp INTEGER
|
|
|
|
|
|
bl-signed = id-signed msp BOOLEAN
|
|
|
|
|
|
Level = id-none / id-simple / id-strong
|
|
|
|
|
|
id-level = %x6C.65.76.65.6C ; "level"
|
|
|
|
|
|
id-localQualifier = %x6C.6F.63.61.6C.51.75.61.6C.69.66.69.65.72
|
|
|
|
|
|
; "localQualifier"
|
|
|
|
|
|
id-signed = %x73.69.67.6E.65.64 ; "signed"
|
|
|
|
|
|
id-none = %x6E.6F.6E.65 ; "none"
|
|
|
|
|
|
id-simple = %x73.69.6D.70.6C.65 ; "simple"
|
|
|
|
|
|
id-strong = %x73.74.72.6F.6E.67 ; "strong"
|
|
|
|
|
|
|
|
|
|
|
|
ItemOrUserFirst = ( id-itemFirst ":" ItemFirst ) /
|
|
|
|
|
|
( id-userFirst ":" UserFirst )
|
|
|
|
|
|
id-itemFirst = %x69.74.65.6D.46.69.72.73.74 ; "itemFirst"
|
|
|
|
|
|
id-userFirst = %x75.73.65.72.46.69.72.73.74 ; "userFirst"
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 31]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
ItemFirst = "{" sp if-protectedItems ","
|
|
|
|
|
|
sp if-itemPermissions
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
if-protectedItems = id-protectedItems msp ProtectedItems
|
|
|
|
|
|
if-itemPermissions = id-itemPermissions msp ItemPermissions
|
|
|
|
|
|
id-protectedItems = %x70.72.6F.74.65.63.74.65.64.49.74.65.6D.73
|
|
|
|
|
|
; "protectedItems"
|
|
|
|
|
|
id-itemPermissions = %x69.74.65.6D.50.65.72.6D.69.73.73.69.6F.6E
|
|
|
|
|
|
%x73 ; "itemPermissions"
|
|
|
|
|
|
|
|
|
|
|
|
UserFirst = "{" sp uf-userClasses ","
|
|
|
|
|
|
sp uf-userPermissions
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
uf-userClasses = id-userClasses msp UserClasses
|
|
|
|
|
|
uf-userPermissions = id-userPermissions msp UserPermissions
|
|
|
|
|
|
id-userClasses = %x75.73.65.72.43.6C.61.73.73.65.73
|
|
|
|
|
|
; "userClasses"
|
|
|
|
|
|
id-userPermissions = %x75.73.65.72.50.65.72.6D.69.73.73.69.6F.6E
|
|
|
|
|
|
%x73 ; "userPermissions"
|
|
|
|
|
|
|
|
|
|
|
|
ItemPermissions = "{" [ sp ItemPermission
|
|
|
|
|
|
*( "," sp ItemPermission ) ] sp "}"
|
|
|
|
|
|
ItemPermission = "{" [ sp ip-precedence "," ]
|
|
|
|
|
|
sp ip-userClasses ","
|
|
|
|
|
|
sp ip-grantsAndDenials
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
ip-precedence = id-precedence msp Precedence
|
|
|
|
|
|
ip-userClasses = id-userClasses msp UserClasses
|
|
|
|
|
|
ip-grantsAndDenials = id-grantsAndDenials msp GrantsAndDenials
|
|
|
|
|
|
id-grantsAndDenials = %x67.72.61.6E.74.73.41.6E.64.44.65.6E.69.61
|
|
|
|
|
|
%x6C.73 ; "grantsAndDenials"
|
|
|
|
|
|
|
|
|
|
|
|
UserClasses = "{" [ sp uc-allUsers ]
|
|
|
|
|
|
[ sep sp uc-thisEntry ]
|
|
|
|
|
|
[ sep sp uc-name ]
|
|
|
|
|
|
[ sep sp uc-userGroup ]
|
|
|
|
|
|
[ sep sp uc-subtree ]
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
uc-allUsers = id-allUsers msp NULL
|
|
|
|
|
|
uc-thisEntry = id-thisEntry msp NULL
|
|
|
|
|
|
uc-name = id-name msp NameAndOptionalUIDs
|
|
|
|
|
|
uc-userGroup = id-userGroup msp NameAndOptionalUIDs
|
|
|
|
|
|
uc-subtree = id-subtree msp SubtreeSpecifications
|
|
|
|
|
|
id-allUsers = %x61.6C.6C.55.73.65.72.73 ; "allUsers"
|
|
|
|
|
|
id-thisEntry = %x74.68.69.73.45.6E.74.72.79 ; "thisEntry"
|
|
|
|
|
|
id-name = %x6E.61.6D.65 ; "name"
|
|
|
|
|
|
id-userGroup = %x75.73.65.72.47.72.6F.75.70 ; "userGroup"
|
|
|
|
|
|
id-subtree = %x73.75.62.74.72.65.65 ; "subtree"
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 32]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
NameAndOptionalUIDs = "{" sp NameAndOptionalUID
|
|
|
|
|
|
*( "," sp NameAndOptionalUID ) sp "}"
|
|
|
|
|
|
NameAndOptionalUID = "{" sp nu-dn
|
|
|
|
|
|
[ "," sp nu-uid ]
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
nu-dn = id-dn msp DistinguishedName
|
|
|
|
|
|
nu-uid = id-uid msp UniqueIdentifier
|
|
|
|
|
|
UniqueIdentifier = BIT-STRING
|
|
|
|
|
|
id-dn = %x64.6E ; "dn"
|
|
|
|
|
|
id-uid = %x75.69.64 ; "uid"
|
|
|
|
|
|
|
|
|
|
|
|
SubtreeSpecifications = "{" sp SubtreeSpecification
|
|
|
|
|
|
*( "," sp SubtreeSpecification ) sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
UserPermissions = "{" [ sp UserPermission
|
|
|
|
|
|
*( "," sp UserPermission ) ] sp "}"
|
|
|
|
|
|
UserPermission = "{" [ sp up-precedence "," ]
|
|
|
|
|
|
sp up-protectedItems ","
|
|
|
|
|
|
sp up-grantsAndDenials
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
up-precedence = id-precedence msp Precedence
|
|
|
|
|
|
up-protectedItems = id-protectedItems msp ProtectedItems
|
|
|
|
|
|
up-grantsAndDenials = id-grantsAndDenials msp GrantsAndDenials
|
|
|
|
|
|
|
|
|
|
|
|
ProtectedItems = "{" [ sp pi-entry ]
|
|
|
|
|
|
[ sep sp pi-allUserAttributeTypes ]
|
|
|
|
|
|
[ sep sp pi-attributeType ]
|
|
|
|
|
|
[ sep sp pi-allAttributeValues ]
|
|
|
|
|
|
[ sep sp pi-allUserTypesAndValues ]
|
|
|
|
|
|
[ sep sp pi-attributeValue ]
|
|
|
|
|
|
[ sep sp pi-selfValue ]
|
|
|
|
|
|
[ sep sp pi-rangeOfValues ]
|
|
|
|
|
|
[ sep sp pi-maxValueCount ]
|
|
|
|
|
|
[ sep sp pi-maxImmSub ]
|
|
|
|
|
|
[ sep sp pi-restrictedBy ]
|
|
|
|
|
|
; contexts omitted
|
|
|
|
|
|
[ sep sp pi-classes ]
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
pi-entry = id-entry msp NULL
|
|
|
|
|
|
pi-allUserAttributeTypes = id-allUserAttributeTypes msp NULL
|
|
|
|
|
|
pi-attributeType = id-attributeType msp AttributeTypes
|
|
|
|
|
|
pi-allAttributeValues = id-allAttributeValues msp
|
|
|
|
|
|
AttributeTypes
|
|
|
|
|
|
pi-allUserTypesAndValues = id-allUserAttributeTypesAndValues msp
|
|
|
|
|
|
NULL
|
|
|
|
|
|
pi-attributeValue = id-attributeValue msp
|
|
|
|
|
|
AttributeTypeAndValues
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 33]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
pi-selfValue = id-selfValue msp AttributeTypes
|
|
|
|
|
|
pi-rangeOfValues = id-rangeOfValues msp Filter
|
|
|
|
|
|
pi-maxValueCount = id-maxValueCount msp MaxValueCounts
|
|
|
|
|
|
pi-maxImmSub = id-maxImmSub msp INTEGER
|
|
|
|
|
|
pi-restrictedBy = id-restrictedBy msp RestrictedValues
|
|
|
|
|
|
pi-classes = id-classes msp Refinement
|
|
|
|
|
|
id-entry = %x65.6E.74.72.79 ; "entry"
|
|
|
|
|
|
id-allUserAttributeTypes = %x61.6C.6C.55.73.65.72.41.74.74.72.69
|
|
|
|
|
|
%x62.75.74.65.54.79.70.65.73
|
|
|
|
|
|
; "allUserAttributeTypes"
|
|
|
|
|
|
id-attributeType = %x61.74.74.72.69.62.75.74.65.54.79.70
|
|
|
|
|
|
%x65 ; "attributeType"
|
|
|
|
|
|
id-allAttributeValues = %x61.6C.6C.41.74.74.72.69.62.75.74.65
|
|
|
|
|
|
%x56.61.6C.75.65.73
|
|
|
|
|
|
; "allAttributeValues"
|
|
|
|
|
|
id-attributeValue = %x61.74.74.72.69.62.75.74.65.56.61.6C
|
|
|
|
|
|
%x75.65 ; "attributeValue"
|
|
|
|
|
|
id-selfValue = %x73.65.6C.66.56.61.6C.75.65
|
|
|
|
|
|
; "selfValue"
|
|
|
|
|
|
id-rangeOfValues = %x72.61.6E.67.65.4F.66.56.61.6C.75.65
|
|
|
|
|
|
%x73 ; "rangeOfValues"
|
|
|
|
|
|
id-maxValueCount = %x6D.61.78.56.61.6C.75.65.43.6F.75.6E
|
|
|
|
|
|
%x74 ; "maxValueCount"
|
|
|
|
|
|
id-maxImmSub = %x6D.61.78.49.6D.6D.53.75.62
|
|
|
|
|
|
; "maxImmSub"
|
|
|
|
|
|
id-restrictedBy = %x72.65.73.74.72.69.63.74.65.64.42.79
|
|
|
|
|
|
; "restrictedBy"
|
|
|
|
|
|
id-classes = %x63.6C.61.73.73.65.73 ; "classes"
|
|
|
|
|
|
|
|
|
|
|
|
id-allUserAttributeTypesAndValues = %x61.6C.6C.55.73.65.72.41.74
|
|
|
|
|
|
%x74.72.69.62.75.74.65.54.79.70.65.73
|
|
|
|
|
|
%x41.6E.64.56.61.6C.75.65.73
|
|
|
|
|
|
; "allUserAttributeTypesAndValues"
|
|
|
|
|
|
|
|
|
|
|
|
AttributeTypes = "{" sp AttributeType
|
|
|
|
|
|
*( "," sp AttributeType ) sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
AttributeTypeAndValues = "{" sp AttributeTypeAndValue
|
|
|
|
|
|
*( "," sp AttributeTypeAndValue )
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
AttributeTypeAndValue = "{" sp atav-type ","
|
|
|
|
|
|
sp atav-value
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
atav-type = id-type msp AttributeType
|
|
|
|
|
|
atav-value = id-value msp Value
|
|
|
|
|
|
id-type = %x74.79.70.65 ; "type"
|
|
|
|
|
|
id-value = %x76.61.6C.75.65 ; "value"
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 34]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
MaxValueCounts = "{" sp MaxValueCount
|
|
|
|
|
|
*( "," sp MaxValueCount ) sp "}"
|
|
|
|
|
|
MaxValueCount = "{" sp mvc-type ","
|
|
|
|
|
|
sp mvc-maxCount
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
mvc-type = id-type msp AttributeType
|
|
|
|
|
|
mvc-maxCount = id-maxCount msp INTEGER
|
|
|
|
|
|
id-maxCount = %x6D.61.78.43.6F.75.6E.74 ; "maxCount"
|
|
|
|
|
|
|
|
|
|
|
|
RestrictedValues = "{" sp RestrictedValue
|
|
|
|
|
|
*( "," sp RestrictedValue ) sp "}"
|
|
|
|
|
|
RestrictedValue = "{" sp rv-type ","
|
|
|
|
|
|
sp rv-valuesin
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
rv-type = id-type msp AttributeType
|
|
|
|
|
|
rv-valuesin = id-valuesin msp AttributeType
|
|
|
|
|
|
id-valuesin = %x76.61.6C.75.65.73.69.6E ; "valuesin"
|
|
|
|
|
|
|
|
|
|
|
|
GrantsAndDenials = "{" [ sp grantOrDeny
|
|
|
|
|
|
*( "," sp grantOrDeny ) ] sp "}"
|
|
|
|
|
|
grantOrDeny = id-grantAdd
|
|
|
|
|
|
/ id-denyAdd
|
|
|
|
|
|
/ id-grantDiscloseOnError
|
|
|
|
|
|
/ id-denyDiscloseOnError
|
|
|
|
|
|
/ id-grantRead
|
|
|
|
|
|
/ id-denyRead
|
|
|
|
|
|
/ id-grantRemove
|
|
|
|
|
|
/ id-denyRemove
|
|
|
|
|
|
/ id-grantBrowse
|
|
|
|
|
|
/ id-denyBrowse
|
|
|
|
|
|
/ id-grantExport
|
|
|
|
|
|
/ id-denyExport
|
|
|
|
|
|
/ id-grantImport
|
|
|
|
|
|
/ id-denyImport
|
|
|
|
|
|
/ id-grantModify
|
|
|
|
|
|
/ id-denyModify
|
|
|
|
|
|
/ id-grantRename
|
|
|
|
|
|
/ id-denyRename
|
|
|
|
|
|
/ id-grantReturnDN
|
|
|
|
|
|
/ id-denyReturnDN
|
|
|
|
|
|
/ id-grantCompare
|
|
|
|
|
|
/ id-denyCompare
|
|
|
|
|
|
/ id-grantFilterMatch
|
|
|
|
|
|
/ id-denyFilterMatch
|
|
|
|
|
|
; grantInvoke omitted
|
|
|
|
|
|
; denyInvoke omitted
|
|
|
|
|
|
|
|
|
|
|
|
id-grantAdd = %x67.72.61.6E.74.41.64.64 ; "grantAdd"
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 35]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
id-denyAdd = %x64.65.6E.79.41.64.64 ; "denyAdd"
|
|
|
|
|
|
id-grantBrowse = %x67.72.61.6E.74.42.72.6F.77.73.65
|
|
|
|
|
|
; "grantBrowse"
|
|
|
|
|
|
id-denyBrowse = %x64.65.6E.79.42.72.6F.77.73.65 ; "denyBrowse"
|
|
|
|
|
|
id-grantCompare = %x67.72.61.6E.74.43.6F.6D.70.61.72.65
|
|
|
|
|
|
; "grantCompare"
|
|
|
|
|
|
id-denyCompare = %x64.65.6E.79.43.6F.6D.70.61.72.65
|
|
|
|
|
|
; "denyCompare"
|
|
|
|
|
|
|
|
|
|
|
|
id-grantDiscloseOnError = %x67.72.61.6E.74.44.69.73.63.6C.6F.73.65
|
|
|
|
|
|
%x4F.6E.45.72.72.6F.72
|
|
|
|
|
|
; "grantDiscloseOnError"
|
|
|
|
|
|
id-denyDiscloseOnError = %x64.65.6E.79.44.69.73.63.6C.6F.73.65.4F
|
|
|
|
|
|
%x6E.45.72.72.6F.72
|
|
|
|
|
|
; "denyDiscloseOnError"
|
|
|
|
|
|
|
|
|
|
|
|
id-grantExport = %x67.72.61.6E.74.45.78.70.6F.72.74
|
|
|
|
|
|
; "grantExport"
|
|
|
|
|
|
id-denyExport = %x64.65.6E.79.45.78.70.6F.72.74
|
|
|
|
|
|
; "denyExport"
|
|
|
|
|
|
id-grantFilterMatch = %x67.72.61.6E.74.46.69.6C.74.65.72.4D.61.74
|
|
|
|
|
|
%x63.68 ; "grantFilterMatch"
|
|
|
|
|
|
id-denyFilterMatch = %x64.65.6E.79.46.69.6C.74.65.72.4D.61.74.63
|
|
|
|
|
|
%x68 ; "denyFilterMatch"
|
|
|
|
|
|
id-grantImport = %x67.72.61.6E.74.49.6D.70.6F.72.74
|
|
|
|
|
|
; "grantImport"
|
|
|
|
|
|
id-denyImport = %x64.65.6E.79.49.6D.70.6F.72.74
|
|
|
|
|
|
; "denyImport"
|
|
|
|
|
|
id-grantModify = %x67.72.61.6E.74.4D.6F.64.69.66.79
|
|
|
|
|
|
; "grantModify"
|
|
|
|
|
|
id-denyModify = %x64.65.6E.79.4D.6F.64.69.66.79
|
|
|
|
|
|
; "denyModify"
|
|
|
|
|
|
id-grantRead = %x67.72.61.6E.74.52.65.61.64 ; "grantRead"
|
|
|
|
|
|
id-denyRead = %x64.65.6E.79.52.65.61.64 ; "denyRead"
|
|
|
|
|
|
id-grantRemove = %x67.72.61.6E.74.52.65.6D.6F.76.65
|
|
|
|
|
|
; "grantRemove"
|
|
|
|
|
|
id-denyRemove = %x64.65.6E.79.52.65.6D.6F.76.65
|
|
|
|
|
|
; "denyRemove"
|
|
|
|
|
|
id-grantRename = %x67.72.61.6E.74.52.65.6E.61.6D.65
|
|
|
|
|
|
; "grantRename"
|
|
|
|
|
|
id-denyRename = %x64.65.6E.79.52.65.6E.61.6D.65
|
|
|
|
|
|
; "denyRename"
|
|
|
|
|
|
id-grantReturnDN = %x67.72.61.6E.74.52.65.74.75.72.6E.44.4E
|
|
|
|
|
|
; "grantReturnDN"
|
|
|
|
|
|
id-denyReturnDN = %x64.65.6E.79.52.65.74.75.72.6E.44.4E
|
|
|
|
|
|
; "denyReturnDN"
|
|
|
|
|
|
|
|
|
|
|
|
The <sp>, <msp>, <sep>, <AttributeType>, <BIT-STRING>, <BOOLEAN>,
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 36]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
<DirectoryString>, <DistinguishedName>, <EXTERNAL>, <INTEGER>,
|
|
|
|
|
|
<INTEGER-0-MAX> and <NULL> rules are described in [GCE].
|
|
|
|
|
|
|
|
|
|
|
|
The <SubtreeSpecification> and <Refinement> rules are described in
|
|
|
|
|
|
[SUBENTRY].
|
|
|
|
|
|
|
|
|
|
|
|
The <Value> rule is described in [GSER].
|
|
|
|
|
|
|
|
|
|
|
|
Filter = filter-item / filter-and / filter-or / filter-not
|
|
|
|
|
|
filter-item = id-item ":" FilterItem
|
|
|
|
|
|
filter-and = id-and ":" SetOfFilter
|
|
|
|
|
|
filter-or = id-or ":" SetOfFilter
|
|
|
|
|
|
filter-not = id-not ":" Filter
|
|
|
|
|
|
id-and = %x61.6E.64 ; "and"
|
|
|
|
|
|
id-item = %x69.74.65.6D ; "item"
|
|
|
|
|
|
id-not = %x6E.6F.74 ; "not"
|
|
|
|
|
|
id-or = %x6F.72 ; "or"
|
|
|
|
|
|
|
|
|
|
|
|
SetOfFilter = "{" [ sp Filter *( "," sp Filter ) ] sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
FilterItem = fi-equality
|
|
|
|
|
|
/ fi-substrings
|
|
|
|
|
|
/ fi-greaterOrEqual
|
|
|
|
|
|
/ fi-lessOrEqual
|
|
|
|
|
|
/ fi-present
|
|
|
|
|
|
/ fi-approximateMatch
|
|
|
|
|
|
/ fi-extensibleMatch
|
|
|
|
|
|
; contextPresent omitted
|
|
|
|
|
|
|
|
|
|
|
|
fi-equality = id-equality ":" AttributeValueAssertion
|
|
|
|
|
|
fi-substrings = id-substrings ":" SubstringsAssertion
|
|
|
|
|
|
fi-greaterOrEqual = id-greaterOrEqual ":"
|
|
|
|
|
|
AttributeValueAssertion
|
|
|
|
|
|
fi-lessOrEqual = id-lessOrEqual ":" AttributeValueAssertion
|
|
|
|
|
|
fi-present = id-present ":" AttributeType
|
|
|
|
|
|
fi-approximateMatch = id-approximateMatch ":"
|
|
|
|
|
|
AttributeValueAssertion
|
|
|
|
|
|
fi-extensibleMatch = id-extensibleMatch ":" MatchingRuleAssertion
|
|
|
|
|
|
id-equality = %x65.71.75.61.6C.69.74.79 ; "equality"
|
|
|
|
|
|
id-substrings = %x73.75.62.73.74.72.69.6E.67.73
|
|
|
|
|
|
; "substrings"
|
|
|
|
|
|
id-greaterOrEqual = %x67.72.65.61.74.65.72.4F.72.45.71.75.61.6C
|
|
|
|
|
|
; "greaterOrEqual"
|
|
|
|
|
|
id-lessOrEqual = %x6C.65.73.73.4F.72.45.71.75.61.6C
|
|
|
|
|
|
; "lessOrEqual"
|
|
|
|
|
|
id-present = %x70.72.65.73.65.6E.74 ; "present"
|
|
|
|
|
|
id-approximateMatch = %x61.70.70.72.6F.78.69.6D.61.74.65.4D.61.74
|
|
|
|
|
|
%x63.68 ; "approximateMatch"
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 37]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
id-extensibleMatch = %x65.78.74.65.6E.73.69.62.6C.65.4D.61.74.63
|
|
|
|
|
|
%x68 ; "extensibleMatch"
|
|
|
|
|
|
|
|
|
|
|
|
AttributeValueAssertion = "{" sp ava-type ","
|
|
|
|
|
|
sp ava-assertion
|
|
|
|
|
|
; assertedContexts omitted
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
ava-type = id-type msp AttributeType
|
|
|
|
|
|
ava-assertion = id-assertion msp Value
|
|
|
|
|
|
id-assertion = %x61.73.73.65.72.74.69.6F.6E ; "assertion"
|
|
|
|
|
|
|
|
|
|
|
|
SubstringsAssertion = "{" sp sa-type ","
|
|
|
|
|
|
sp sa-strings
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
sa-type = id-type msp AttributeType
|
|
|
|
|
|
sa-strings = id-strings msp Substrings
|
|
|
|
|
|
id-strings = %x73.74.72.69.6E.67.73 ; "strings"
|
|
|
|
|
|
|
|
|
|
|
|
Substrings = "{" [ sp Substring *( "," sp Substring ) ] sp "}"
|
|
|
|
|
|
Substring = ss-initial
|
|
|
|
|
|
/ ss-any
|
|
|
|
|
|
/ ss-final
|
|
|
|
|
|
; control omitted
|
|
|
|
|
|
ss-initial = id-initial ":" Value
|
|
|
|
|
|
ss-any = id-any ":" Value
|
|
|
|
|
|
ss-final = id-final ":" Value
|
|
|
|
|
|
id-initial = %x69.6E.69.74.69.61.6C ; "initial"
|
|
|
|
|
|
id-any = %x61.6E.79 ; "any"
|
|
|
|
|
|
id-final = %x66.69.6E.61.6C ; "final"
|
|
|
|
|
|
|
|
|
|
|
|
MatchingRuleAssertion = "{" sp mra-matchingRule
|
|
|
|
|
|
[ "," sp mra-type ]
|
|
|
|
|
|
"," sp mra-matchValue
|
|
|
|
|
|
[ "," sp mra-dnAttributes ]
|
|
|
|
|
|
sp "}"
|
|
|
|
|
|
|
|
|
|
|
|
mra-matchingRule = id-matchingRule msp MatchingRuleIds
|
|
|
|
|
|
mra-type = id-type msp AttributeType
|
|
|
|
|
|
mra-matchValue = id-matchValue msp Value
|
|
|
|
|
|
mra-dnAttributes = id-dnAttributes msp BOOLEAN
|
|
|
|
|
|
id-matchingRule = %x6D.61.74.63.68.69.6E.67.52.75.6C.65
|
|
|
|
|
|
; "matchingRule"
|
|
|
|
|
|
id-matchValue = %x6D.61.74.63.68.56.61.6C.75.65 ; "matchValue"
|
|
|
|
|
|
id-dnAttributes = %x64.6E.41.74.74.72.69.62.75.74.65.73
|
|
|
|
|
|
; "dnAttributes"
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 38]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
MatchingRuleIds = "{" sp MatchingRuleId *( "," sp MatchingRuleId ) sp "}"
|
|
|
|
|
|
MatchingRuleId = OBJECT-IDENTIFIER
|
|
|
|
|
|
|
|
|
|
|
|
The <OBJECT-IDENTIFIER> rule is described in [GCE].
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Normative References
|
|
|
|
|
|
|
|
|
|
|
|
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
|
|
|
|
|
|
Requirement Levels", BCP 14, RFC 2119, March 1997.
|
|
|
|
|
|
|
|
|
|
|
|
[RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory
|
|
|
|
|
|
Access Protocol (v3)", RFC 2251, December 1997.
|
|
|
|
|
|
|
|
|
|
|
|
[RFC2252] Wahl, M., Coulbeck, A., Howes, T. and S. Kille,
|
|
|
|
|
|
"Lightweight Directory Access Protocol (v3): Attribute
|
|
|
|
|
|
Syntax Definitions", RFC 2252, December 1997.
|
|
|
|
|
|
|
|
|
|
|
|
[RFC2256] Wahl, M., "A Summary of the X.500(96) User Schema for use
|
|
|
|
|
|
with LDAPv3", RFC 2256, December 1997.
|
|
|
|
|
|
|
|
|
|
|
|
[RFC3377] Hodges, J. and R. Morgan, "Lightweight Directory Access
|
|
|
|
|
|
Protocol (v3): Technical Specification", RFC 3377,
|
|
|
|
|
|
September 2002.
|
|
|
|
|
|
|
|
|
|
|
|
[BCP64] Zeilenga, K., "Internet Assigned Numbers
|
|
|
|
|
|
Authority (IANA) Considerations for the Lightweight
|
|
|
|
|
|
Directory Access Protcol (LDAP)", BCP 64, RFC 3383,
|
|
|
|
|
|
September 2002.
|
|
|
|
|
|
|
|
|
|
|
|
[GSER] Legg, S., "Generic String Encoding Rules for ASN.1 Types",
|
|
|
|
|
|
RFC 3641, October 2003.
|
|
|
|
|
|
|
|
|
|
|
|
[COLLECT] Zeilenga, K., "Collective Attributes in the Lightweight
|
|
|
|
|
|
Directory Access Protocol (LDAP)", RFC 3671, December
|
|
|
|
|
|
2003.
|
|
|
|
|
|
|
|
|
|
|
|
[SUBENTRY] Zeilenga, K. and S. Legg, "Subentries in the Lightweight
|
|
|
|
|
|
Directory Access Protocol (LDAP)", RFC 3672, December
|
|
|
|
|
|
2003.
|
|
|
|
|
|
|
|
|
|
|
|
[SCHEMA] Zeilenga, K., "Lightweight Directory Access Protocol
|
|
|
|
|
|
(LDAP): Additional Matching Rules", RFC 3698, February
|
|
|
|
|
|
2004.
|
|
|
|
|
|
|
|
|
|
|
|
[ADMIN] Legg, S., "Lightweight Directory Access Protocol (LDAP):
|
|
|
|
|
|
Directory Administrative Model",
|
|
|
|
|
|
draft-legg-ldap-admin-xx.txt, a work in progress, June
|
|
|
|
|
|
2004.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legg Expires 16 December 2004 [Page 39]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[ACA] Legg, S., "Lightweight Directory Access Protocol (LDAP):
|
|
|
|
|
|
Access Control Administration",
|
|
|
|
|
|
draft-legg-ldap-acm-admin-xx.txt, a work in progress, June
|
|
|
|
|
|
2004.
|
|
|
|
|
|
|
|
|
|
|
|
[FILTER] Zeilenga, K., "LDAP Absolute True and False Filters",
|
|
|
|
|
|
draft-zeilenga-ldap-t-f-xx.txt, a work in progress,
|
|
|
|
|
|
February 2004.
|
|
|
|
|
|
|
|
|
|
|
|
[ASN1] ITU-T Recommendation X.680 (07/02) | ISO/IEC 8824-1,
|
|
|
|
|
|
Information technology - Abstract Syntax Notation One
|
|
|
|
|
|
(ASN.1): Specification of basic notation
|
|
|
|
|
|
|
|
|
|
|
|
Informative References
|
|
|
|
|
|
|
|
|
|
|
|
[RFC2234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
|
|
|
|
|
|
Specifications: ABNF", RFC 2234, November 1997.
|
|
|
|
|
|
|
|
|
|
|
|
[GCE] Legg, S., "Common Elements of Generic String Encoding
|
|
|
|
|
|
Rules (GSER) Encodings", RFC 3642, October 2003.
|
|
|
|
|
|
|
|
|
|
|
|
[X501] ITU-T Recommendation X.501 (02/01) | ISO/IEC 9594-2:2001,
|
|
|
|
|
|
Information technology - Open Systems Interconnection -
|
|
|
|
|
|
The Directory: Models
|
|
|
|
|
|
|
|
|
|
|
|
[X511] ITU-T Recommendation X.511 (02/01) | ISO/IEC 9594-3:2001,
|
|
|
|
|
|
Information technology - Open Systems Interconnection -
|
|
|
|
|
|
The Directory: Abstract service definition
|
|
|
|
|
|
|
|
|
|
|
|
Author's Address
|
|
|
|
|
|
|
|
|
|
|
|
Steven Legg
|
|
|
|
|
|
Adacel Technologies Ltd.
|
|
|
|
|
|
250 Bay Street
|
|
|
|
|
|
Brighton, Victoria 3186
|
|
|
|
|
|
AUSTRALIA
|
|
|
|
|
|
|
|
|
|
|
|
Phone: +61 3 8530 7710
|
|
|
|
|
|
Fax: +61 3 8530 7888
|
|
|
|
|
|
EMail: steven.legg@adacel.com.au
|
|
|
|
|
|
|
|
|
|
|
|
Full Copyright Statement
|
|
|
|
|
|
|
|
|
|
|
|
Copyright (C) The Internet Society (2004). This document is subject
|
|
|
|
|
|
to the rights, licenses and restrictions contained in BCP 78, and
|
|
|
|
|
|
except as set forth therein, the authors retain all their rights.
|
|
|
|
|
|
|
|
|
|
|
|
This document and the information contained herein are provided on an
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 40]
|
|
|
|
|
|
|
|
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
|
|
|
|
|
|
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
|
|
|
|
|
|
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
|
|
|
|
|
|
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
|
|
|
|
|
|
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
|
|
|
|
|
|
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
|
|
|
|
|
|
|
|
|
|
|
|
Intellectual Property
|
|
|
|
|
|
|
|
|
|
|
|
The IETF takes no position regarding the validity or scope of any
|
|
|
|
|
|
Intellectual Property Rights or other rights that might be claimed to
|
|
|
|
|
|
pertain to the implementation or use of the technology described in
|
|
|
|
|
|
this document or the extent to which any license under such rights
|
|
|
|
|
|
might or might not be available; nor does it represent that it has
|
|
|
|
|
|
made any independent effort to identify any such rights. Information
|
|
|
|
|
|
on the procedures with respect to rights in RFC documents can be
|
|
|
|
|
|
found in BCP 78 and BCP 79.
|
|
|
|
|
|
|
|
|
|
|
|
Copies of IPR disclosures made to the IETF Secretariat and any
|
|
|
|
|
|
assurances of licenses to be made available, or the result of an
|
|
|
|
|
|
attempt made to obtain a general license or permission for the use of
|
|
|
|
|
|
such proprietary rights by implementers or users of this
|
|
|
|
|
|
specification can be obtained from the IETF on-line IPR repository at
|
|
|
|
|
|
http://www.ietf.org/ipr.
|
|
|
|
|
|
|
|
|
|
|
|
The IETF invites any interested party to bring to its attention any
|
|
|
|
|
|
copyrights, patents or patent applications, or other proprietary
|
|
|
|
|
|
rights that may cover technology that may be required to implement
|
|
|
|
|
|
this standard. Please address the information to the IETF at
|
|
|
|
|
|
ietf-ipr@ietf.org.
|
|
|
|
|
|
|
|
|
|
|
|
Changes in Draft 01
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
The Internet draft draft-legg-ldap-acm-admin-00.txt has been split
|
|
|
|
|
|
into two drafts, draft-legg-ldap-admin-00.txt and
|
|
|
|
|
|
draft-legg-ldap-acm-admin-01.txt. Section 8 of
|
|
|
|
|
|
draft-legg-ldapext-component-matching-06.txt has been extracted to
|
|
|
|
|
|
become a separate Internet draft, draft-legg-ldap-gser-xx.txt. The
|
|
|
|
|
|
references in this document have been updated accordingly.
|
|
|
|
|
|
|
|
|
|
|
|
The term "native LDAP encoding" has been replaced by the term
|
|
|
|
|
|
"LDAP-specific encoding" to align with terminology anticipated to be
|
|
|
|
|
|
used in the revision of RFC 2252.
|
|
|
|
|
|
|
|
|
|
|
|
Changes have been made to the Search Operation Decision Points
|
2004-08-28 02:41:02 +08:00
|
|
|
|
(Section 3.4.3):
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
In 4) a), the assumed FilterMatch permission for a present match of
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 41]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
INTERNET-DRAFT Basic and Simplified Access Control June 16, 2004
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
the objectClass attribute has been removed. An LDAP search with a
|
|
|
|
|
|
True filter [FILTER] is the best analogue of the DAP read operation.
|
|
|
|
|
|
A True filter does not filter any attribute type and therefore does
|
|
|
|
|
|
not require FilterMatch permissions to succeed.
|
|
|
|
|
|
|
2003-06-01 06:47:07 +08:00
|
|
|
|
In 5) b) and c), there is an additional requirement for Read
|
|
|
|
|
|
permission for at least one attribute value before an attribute type
|
|
|
|
|
|
can be returned in a search result. Without this change a search
|
|
|
|
|
|
result could, in some circumstances, disclose the existence of
|
|
|
|
|
|
particular hidden attribute values.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Changes in Draft 02
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
RFC 3377 replaces RFC 2251 as the reference for LDAP.
|
|
|
|
|
|
|
|
|
|
|
|
An IANA Considerations section has been added.
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Changes in Draft 03
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
The document has been reformatted in line with current practice.
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
Legg Expires 16 December 2004 [Page 42]
|
2003-06-01 06:47:07 +08:00
|
|
|
|
|
2004-08-28 02:41:02 +08:00
|
|
|
|
|
