| 1 |
|
|---|
| 2 |
|
|---|
| 3 |
|
|---|
| 4 |
|
|---|
| 5 |
|
|---|
| 6 |
|
|---|
| 7 | Network Working Group K. Zeilenga
|
|---|
| 8 | Request for Comments: 4523 OpenLDAP Foundation
|
|---|
| 9 | Obsoletes: 2252, 2256, 2587 June 2006
|
|---|
| 10 | Category: Standards Track
|
|---|
| 11 |
|
|---|
| 12 |
|
|---|
| 13 | Lightweight Directory Access Protocol (LDAP)
|
|---|
| 14 | Schema Definitions for X.509 Certificates
|
|---|
| 15 |
|
|---|
| 16 | Status of This Memo
|
|---|
| 17 |
|
|---|
| 18 | This document specifies an Internet standards track protocol for the
|
|---|
| 19 | Internet community, and requests discussion and suggestions for
|
|---|
| 20 | improvements. Please refer to the current edition of the "Internet
|
|---|
| 21 | Official Protocol Standards" (STD 1) for the standardization state
|
|---|
| 22 | and status of this protocol. Distribution of this memo is unlimited.
|
|---|
| 23 |
|
|---|
| 24 | Copyright Notice
|
|---|
| 25 |
|
|---|
| 26 | Copyright (C) The Internet Society (2006).
|
|---|
| 27 |
|
|---|
| 28 | Abstract
|
|---|
| 29 |
|
|---|
| 30 | This document describes schema for representing X.509 certificates,
|
|---|
| 31 | X.521 security information, and related elements in directories
|
|---|
| 32 | accessible using the Lightweight Directory Access Protocol (LDAP).
|
|---|
| 33 | The LDAP definitions for these X.509 and X.521 schema elements
|
|---|
| 34 | replace those provided in RFCs 2252 and 2256.
|
|---|
| 35 |
|
|---|
| 36 | 1. Introduction
|
|---|
| 37 |
|
|---|
| 38 | This document provides LDAP [RFC4510] schema definitions [RFC4512]
|
|---|
| 39 | for a subset of elements specified in X.509 [X.509] and X.521
|
|---|
| 40 | [X.521], including attribute types for certificates, cross
|
|---|
| 41 | certificate pairs, and certificate revocation lists; matching rules
|
|---|
| 42 | to be used with these attribute types; and related object classes.
|
|---|
| 43 | LDAP syntax definitions are also provided for associated assertion
|
|---|
| 44 | and attribute values.
|
|---|
| 45 |
|
|---|
| 46 | As the semantics of these elements are as defined in X.509 and X.521,
|
|---|
| 47 | knowledge of X.509 and X.521 is necessary to make use of the LDAP
|
|---|
| 48 | schema definitions provided herein.
|
|---|
| 49 |
|
|---|
| 50 | This document, together with [RFC4510], obsoletes RFCs 2252 and 2256
|
|---|
| 51 | in their entirety. The changes (in this document) made since RFC
|
|---|
| 52 | 2252 and RFC 2256 include:
|
|---|
| 53 |
|
|---|
| 54 | - addition of pkiUser, pkiCA, and deltaCRL classes;
|
|---|
| 55 |
|
|---|
| 56 |
|
|---|
| 57 |
|
|---|
| 58 | Zeilenga Standards Track [Page 1]
|
|---|
| 59 | |
|---|
| 60 |
|
|---|
| 61 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 62 |
|
|---|
| 63 |
|
|---|
| 64 | - update of attribute types to include equality matching rules in
|
|---|
| 65 | accordance with their X.500 specifications;
|
|---|
| 66 |
|
|---|
| 67 | - addition of certificate, certificate pair, certificate list,
|
|---|
| 68 | and algorithm identifier matching rules; and
|
|---|
| 69 |
|
|---|
| 70 | - addition of LDAP syntax for assertion syntaxes for these
|
|---|
| 71 | matching rules.
|
|---|
| 72 |
|
|---|
| 73 | This document obsoletes RFC 2587. The X.509 schema descriptions for
|
|---|
| 74 | LDAPv2 [RFC1777] are Historic, as is LDAPv2 [RFC3494].
|
|---|
| 75 |
|
|---|
| 76 | The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
|
|---|
| 77 | "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
|
|---|
| 78 | document are to be interpreted as described in BCP 14 [RFC2119].
|
|---|
| 79 |
|
|---|
| 80 | Schema definitions are provided using LDAP description formats
|
|---|
| 81 | [RFC4512]. Definitions provided here are formatted (line wrapped)
|
|---|
| 82 | for readability.
|
|---|
| 83 |
|
|---|
| 84 | 2. Syntaxes
|
|---|
| 85 |
|
|---|
| 86 | This section describes various syntaxes used in LDAP to transfer
|
|---|
| 87 | certificates and related data types.
|
|---|
| 88 |
|
|---|
| 89 | 2.1. Certificate
|
|---|
| 90 |
|
|---|
| 91 | ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'X.509 Certificate' )
|
|---|
| 92 |
|
|---|
| 93 | A value of this syntax is an X.509 Certificate [X.509, clause 7].
|
|---|
| 94 |
|
|---|
| 95 | Due to changes made to the definition of a Certificate through time,
|
|---|
| 96 | no LDAP-specific encoding is defined for this syntax. Values of this
|
|---|
| 97 | syntax SHOULD be encoded using Distinguished Encoding Rules (DER)
|
|---|
| 98 | [X.690] and MUST only be transferred using the ;binary transfer
|
|---|
| 99 | option [RFC4522]; that is, by requesting and returning values using
|
|---|
| 100 | attribute descriptions such as "userCertificate;binary".
|
|---|
| 101 |
|
|---|
| 102 | As values of this syntax contain digitally signed data, values of
|
|---|
| 103 | this syntax and the form of each value MUST be preserved as
|
|---|
| 104 | presented.
|
|---|
| 105 |
|
|---|
| 106 | 2.2. CertificateList
|
|---|
| 107 |
|
|---|
| 108 | ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'X.509 Certificate List' )
|
|---|
| 109 |
|
|---|
| 110 | A value of this syntax is an X.509 CertificateList [X.509, clause
|
|---|
| 111 | 7.3].
|
|---|
| 112 |
|
|---|
| 113 |
|
|---|
| 114 |
|
|---|
| 115 | Zeilenga Standards Track [Page 2]
|
|---|
| 116 | |
|---|
| 117 |
|
|---|
| 118 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 119 |
|
|---|
| 120 |
|
|---|
| 121 | Due to changes made to the definition of a CertificateList through
|
|---|
| 122 | time, no LDAP-specific encoding is defined for this syntax. Values
|
|---|
| 123 | of this syntax SHOULD be encoded using DER [X.690] and MUST only be
|
|---|
| 124 | transferred using the ;binary transfer option [RFC4522]; that is, by
|
|---|
| 125 | requesting and returning values using attribute descriptions such as
|
|---|
| 126 | "certificateRevocationList;binary".
|
|---|
| 127 |
|
|---|
| 128 | As values of this syntax contain digitally signed data, values of
|
|---|
| 129 | this syntax and the form of each value MUST be preserved as
|
|---|
| 130 | presented.
|
|---|
| 131 |
|
|---|
| 132 | 2.3. CertificatePair
|
|---|
| 133 |
|
|---|
| 134 | ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'X.509 Certificate Pair' )
|
|---|
| 135 |
|
|---|
| 136 | A value of this syntax is an X.509 CertificatePair [X.509, clause
|
|---|
| 137 | 11.2.3].
|
|---|
| 138 |
|
|---|
| 139 | Due to changes made to the definition of an X.509 CertificatePair
|
|---|
| 140 | through time, no LDAP-specific encoding is defined for this syntax.
|
|---|
| 141 | Values of this syntax SHOULD be encoded using DER [X.690] and MUST
|
|---|
| 142 | only be transferred using the ;binary transfer option [RFC4522]; that
|
|---|
| 143 | is, by requesting and returning values using attribute descriptions
|
|---|
| 144 | such as "crossCertificatePair;binary".
|
|---|
| 145 |
|
|---|
| 146 | As values of this syntax contain digitally signed data, values of
|
|---|
| 147 | this syntax and the form of each value MUST be preserved as
|
|---|
| 148 | presented.
|
|---|
| 149 |
|
|---|
| 150 | 2.4. SupportedAlgorithm
|
|---|
| 151 |
|
|---|
| 152 | ( 1.3.6.1.4.1.1466.115.121.1.49
|
|---|
| 153 | DESC 'X.509 Supported Algorithm' )
|
|---|
| 154 |
|
|---|
| 155 | A value of this syntax is an X.509 SupportedAlgorithm [X.509, clause
|
|---|
| 156 | 11.2.7].
|
|---|
| 157 |
|
|---|
| 158 | Due to changes made to the definition of an X.509 SupportedAlgorithm
|
|---|
| 159 | through time, no LDAP-specific encoding is defined for this syntax.
|
|---|
| 160 | Values of this syntax SHOULD be encoded using DER [X.690] and MUST
|
|---|
| 161 | only be transferred using the ;binary transfer option [RFC4522]; that
|
|---|
| 162 | is, by requesting and returning values using attribute descriptions
|
|---|
| 163 | such as "supportedAlgorithms;binary".
|
|---|
| 164 |
|
|---|
| 165 | As values of this syntax contain digitally signed data, values of
|
|---|
| 166 | this syntax and the form of the value MUST be preserved as presented.
|
|---|
| 167 |
|
|---|
| 168 |
|
|---|
| 169 |
|
|---|
| 170 |
|
|---|
| 171 |
|
|---|
| 172 | Zeilenga Standards Track [Page 3]
|
|---|
| 173 | |
|---|
| 174 |
|
|---|
| 175 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 176 |
|
|---|
| 177 |
|
|---|
| 178 | 2.5. CertificateExactAssertion
|
|---|
| 179 |
|
|---|
| 180 | ( 1.3.6.1.1.15.1 DESC 'X.509 Certificate Exact Assertion' )
|
|---|
| 181 |
|
|---|
| 182 | A value of this syntax is an X.509 CertificateExactAssertion [X.509,
|
|---|
| 183 | clause 11.3.1]. Values of this syntax MUST be encoded using the
|
|---|
| 184 | Generic String Encoding Rules (GSER) [RFC3641]. Appendix A.1
|
|---|
| 185 | provides an equivalent Augmented Backus-Naur Form (ABNF) [RFC4234]
|
|---|
| 186 | grammar for this syntax.
|
|---|
| 187 |
|
|---|
| 188 | 2.6. CertificateAssertion
|
|---|
| 189 |
|
|---|
| 190 | ( 1.3.6.1.1.15.2 DESC 'X.509 Certificate Assertion' )
|
|---|
| 191 |
|
|---|
| 192 | A value of this syntax is an X.509 CertificateAssertion [X.509,
|
|---|
| 193 | clause 11.3.2]. Values of this syntax MUST be encoded using GSER
|
|---|
| 194 | [RFC3641]. Appendix A.2 provides an equivalent ABNF [RFC4234]
|
|---|
| 195 | grammar for this syntax.
|
|---|
| 196 |
|
|---|
| 197 | 2.7. CertificatePairExactAssertion
|
|---|
| 198 |
|
|---|
| 199 | ( 1.3.6.1.1.15.3
|
|---|
| 200 | DESC 'X.509 Certificate Pair Exact Assertion' )
|
|---|
| 201 |
|
|---|
| 202 | A value of this syntax is an X.509 CertificatePairExactAssertion
|
|---|
| 203 | [X.509, clause 11.3.3]. Values of this syntax MUST be encoded using
|
|---|
| 204 | GSER [RFC3641]. Appendix A.3 provides an equivalent ABNF [RFC4234]
|
|---|
| 205 | grammar for this syntax.
|
|---|
| 206 |
|
|---|
| 207 | 2.8. CertificatePairAssertion
|
|---|
| 208 |
|
|---|
| 209 | ( 1.3.6.1.1.15.4 DESC 'X.509 Certificate Pair Assertion' )
|
|---|
| 210 |
|
|---|
| 211 | A value of this syntax is an X.509 CertificatePairAssertion [X.509,
|
|---|
| 212 | clause 11.3.4]. Values of this syntax MUST be encoded using GSER
|
|---|
| 213 | [RFC3641]. Appendix A.4 provides an equivalent ABNF [RFC4234]
|
|---|
| 214 | grammar for this syntax.
|
|---|
| 215 |
|
|---|
| 216 | 2.9. CertificateListExactAssertion
|
|---|
| 217 |
|
|---|
| 218 | ( 1.3.6.1.1.15.5
|
|---|
| 219 | DESC 'X.509 Certificate List Exact Assertion' )
|
|---|
| 220 |
|
|---|
| 221 | A value of this syntax is an X.509 CertificateListExactAssertion
|
|---|
| 222 | [X.509, clause 11.3.5]. Values of this syntax MUST be encoded using
|
|---|
| 223 | GSER [RFC3641]. Appendix A.5 provides an equivalent ABNF grammar for
|
|---|
| 224 | this syntax.
|
|---|
| 225 |
|
|---|
| 226 |
|
|---|
| 227 |
|
|---|
| 228 |
|
|---|
| 229 | Zeilenga Standards Track [Page 4]
|
|---|
| 230 | |
|---|
| 231 |
|
|---|
| 232 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 233 |
|
|---|
| 234 |
|
|---|
| 235 | 2.10. CertificateListAssertion
|
|---|
| 236 |
|
|---|
| 237 | ( 1.3.6.1.1.15.6 DESC 'X.509 Certificate List Assertion' )
|
|---|
| 238 |
|
|---|
| 239 | A value of this syntax is an X.509 CertificateListAssertion [X.509,
|
|---|
| 240 | clause 11.3.6]. Values of this syntax MUST be encoded using GSER
|
|---|
| 241 | [RFC3641]. Appendix A.6 provides an equivalent ABNF [RFC4234]
|
|---|
| 242 | grammar for this syntax.
|
|---|
| 243 |
|
|---|
| 244 | 2.11. AlgorithmIdentifier
|
|---|
| 245 |
|
|---|
| 246 | ( 1.3.6.1.1.15.7 DESC 'X.509 Algorithm Identifier' )
|
|---|
| 247 |
|
|---|
| 248 | A value of this syntax is an X.509 AlgorithmIdentifier [X.509, Clause
|
|---|
| 249 | 7]. Values of this syntax MUST be encoded using GSER [RFC3641].
|
|---|
| 250 |
|
|---|
| 251 | Appendix A.7 provides an equivalent ABNF [RFC4234] grammar for this
|
|---|
| 252 | syntax.
|
|---|
| 253 |
|
|---|
| 254 | 3. Matching Rules
|
|---|
| 255 |
|
|---|
| 256 | This section introduces a set of certificate and related matching
|
|---|
| 257 | rules for use in LDAP. These rules are intended to act in accordance
|
|---|
| 258 | with their X.500 counterparts.
|
|---|
| 259 |
|
|---|
| 260 | 3.1. certificateExactMatch
|
|---|
| 261 |
|
|---|
| 262 | The certificateExactMatch matching rule compares the presented
|
|---|
| 263 | certificate exact assertion value with an attribute value of the
|
|---|
| 264 | certificate syntax as described in clause 11.3.1 of [X.509].
|
|---|
| 265 |
|
|---|
| 266 | ( 2.5.13.34 NAME 'certificateExactMatch'
|
|---|
| 267 | DESC 'X.509 Certificate Exact Match'
|
|---|
| 268 | SYNTAX 1.3.6.1.1.15.1 )
|
|---|
| 269 |
|
|---|
| 270 | 3.2. certificateMatch
|
|---|
| 271 |
|
|---|
| 272 | The certificateMatch matching rule compares the presented certificate
|
|---|
| 273 | assertion value with an attribute value of the certificate syntax as
|
|---|
| 274 | described in clause 11.3.2 of [X.509].
|
|---|
| 275 |
|
|---|
| 276 | ( 2.5.13.35 NAME 'certificateMatch'
|
|---|
| 277 | DESC 'X.509 Certificate Match'
|
|---|
| 278 | SYNTAX 1.3.6.1.1.15.2 )
|
|---|
| 279 |
|
|---|
| 280 |
|
|---|
| 281 |
|
|---|
| 282 |
|
|---|
| 283 |
|
|---|
| 284 |
|
|---|
| 285 |
|
|---|
| 286 | Zeilenga Standards Track [Page 5]
|
|---|
| 287 | |
|---|
| 288 |
|
|---|
| 289 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 290 |
|
|---|
| 291 |
|
|---|
| 292 | 3.3. certificatePairExactMatch
|
|---|
| 293 |
|
|---|
| 294 | The certificatePairExactMatch matching rule compares the presented
|
|---|
| 295 | certificate pair exact assertion value with an attribute value of the
|
|---|
| 296 | certificate pair syntax as described in clause 11.3.3 of [X.509].
|
|---|
| 297 |
|
|---|
| 298 | ( 2.5.13.36 NAME 'certificatePairExactMatch'
|
|---|
| 299 | DESC 'X.509 Certificate Pair Exact Match'
|
|---|
| 300 | SYNTAX 1.3.6.1.1.15.3 )
|
|---|
| 301 |
|
|---|
| 302 | 3.4. certificatePairMatch
|
|---|
| 303 |
|
|---|
| 304 | The certificatePairMatch matching rule compares the presented
|
|---|
| 305 | certificate pair assertion value with an attribute value of the
|
|---|
| 306 | certificate pair syntax as described in clause 11.3.4 of [X.509].
|
|---|
| 307 |
|
|---|
| 308 | ( 2.5.13.37 NAME 'certificatePairMatch'
|
|---|
| 309 | DESC 'X.509 Certificate Pair Match'
|
|---|
| 310 | SYNTAX 1.3.6.1.1.15.4 )
|
|---|
| 311 |
|
|---|
| 312 | 3.5. certificateListExactMatch
|
|---|
| 313 |
|
|---|
| 314 | The certificateListExactMatch matching rule compares the presented
|
|---|
| 315 | certificate list exact assertion value with an attribute value of the
|
|---|
| 316 | certificate pair syntax as described in clause 11.3.5 of [X.509].
|
|---|
| 317 |
|
|---|
| 318 | ( 2.5.13.38 NAME 'certificateListExactMatch'
|
|---|
| 319 | DESC 'X.509 Certificate List Exact Match'
|
|---|
| 320 | SYNTAX 1.3.6.1.1.15.5 )
|
|---|
| 321 |
|
|---|
| 322 | 3.6. certificateListMatch
|
|---|
| 323 |
|
|---|
| 324 | The certificateListMatch matching rule compares the presented
|
|---|
| 325 | certificate list assertion value with an attribute value of the
|
|---|
| 326 | certificate pair syntax as described in clause 11.3.6 of [X.509].
|
|---|
| 327 |
|
|---|
| 328 | ( 2.5.13.39 NAME 'certificateListMatch'
|
|---|
| 329 | DESC 'X.509 Certificate List Match'
|
|---|
| 330 | SYNTAX 1.3.6.1.1.15.6 )
|
|---|
| 331 |
|
|---|
| 332 |
|
|---|
| 333 |
|
|---|
| 334 |
|
|---|
| 335 |
|
|---|
| 336 |
|
|---|
| 337 |
|
|---|
| 338 |
|
|---|
| 339 |
|
|---|
| 340 |
|
|---|
| 341 |
|
|---|
| 342 |
|
|---|
| 343 | Zeilenga Standards Track [Page 6]
|
|---|
| 344 | |
|---|
| 345 |
|
|---|
| 346 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 347 |
|
|---|
| 348 |
|
|---|
| 349 | 3.7. algorithmIdentifierMatch
|
|---|
| 350 |
|
|---|
| 351 | The algorithmIdentifierMatch mating rule compares a presented
|
|---|
| 352 | algorithm identifier with an attribute value of the supported
|
|---|
| 353 | algorithm as described in clause 11.3.7 of [X.509].
|
|---|
| 354 |
|
|---|
| 355 | ( 2.5.13.40 NAME 'algorithmIdentifier'
|
|---|
| 356 | DESC 'X.509 Algorithm Identifier Match'
|
|---|
| 357 | SYNTAX 1.3.6.1.1.15.7 )
|
|---|
| 358 |
|
|---|
| 359 | 4. Attribute Types
|
|---|
| 360 |
|
|---|
| 361 | This section details a set of certificate and related attribute types
|
|---|
| 362 | for use in LDAP.
|
|---|
| 363 |
|
|---|
| 364 | 4.1. userCertificate
|
|---|
| 365 |
|
|---|
| 366 | The userCertificate attribute holds the X.509 certificates issued to
|
|---|
| 367 | the user by one or more certificate authorities, as discussed in
|
|---|
| 368 | clause 11.2.1 of [X.509].
|
|---|
| 369 |
|
|---|
| 370 | ( 2.5.4.36 NAME 'userCertificate'
|
|---|
| 371 | DESC 'X.509 user certificate'
|
|---|
| 372 | EQUALITY certificateExactMatch
|
|---|
| 373 | SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )
|
|---|
| 374 |
|
|---|
| 375 | As required by this attribute type's syntax, values of this attribute
|
|---|
| 376 | are requested and transferred using the attribute description
|
|---|
| 377 | "userCertificate;binary".
|
|---|
| 378 |
|
|---|
| 379 | 4.2. cACertificate
|
|---|
| 380 |
|
|---|
| 381 | The cACertificate attribute holds the X.509 certificates issued to
|
|---|
| 382 | the certificate authority (CA), as discussed in clause 11.2.2 of
|
|---|
| 383 | [X.509].
|
|---|
| 384 |
|
|---|
| 385 | ( 2.5.4.37 NAME 'cACertificate'
|
|---|
| 386 | DESC 'X.509 CA certificate'
|
|---|
| 387 | EQUALITY certificateExactMatch
|
|---|
| 388 | SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )
|
|---|
| 389 |
|
|---|
| 390 | As required by this attribute type's syntax, values of this attribute
|
|---|
| 391 | are requested and transferred using the attribute description
|
|---|
| 392 | "cACertificate;binary".
|
|---|
| 393 |
|
|---|
| 394 |
|
|---|
| 395 |
|
|---|
| 396 |
|
|---|
| 397 |
|
|---|
| 398 |
|
|---|
| 399 |
|
|---|
| 400 | Zeilenga Standards Track [Page 7]
|
|---|
| 401 | |
|---|
| 402 |
|
|---|
| 403 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 404 |
|
|---|
| 405 |
|
|---|
| 406 | 4.3. crossCertificatePair
|
|---|
| 407 |
|
|---|
| 408 | The crossCertificatePair attribute holds an X.509 certificate pair,
|
|---|
| 409 | as discussed in clause 11.2.3 of [X.509].
|
|---|
| 410 |
|
|---|
| 411 | ( 2.5.4.40 NAME 'crossCertificatePair'
|
|---|
| 412 | DESC 'X.509 cross certificate pair'
|
|---|
| 413 | EQUALITY certificatePairExactMatch
|
|---|
| 414 | SYNTAX 1.3.6.1.4.1.1466.115.121.1.10 )
|
|---|
| 415 |
|
|---|
| 416 | As required by this attribute type's syntax, values of this attribute
|
|---|
| 417 | are requested and transferred using the attribute description
|
|---|
| 418 | "crossCertificatePair;binary".
|
|---|
| 419 |
|
|---|
| 420 | 4.4. certificateRevocationList
|
|---|
| 421 |
|
|---|
| 422 | The certificateRevocationList attribute holds certificate lists, as
|
|---|
| 423 | discussed in 11.2.4 of [X.509].
|
|---|
| 424 |
|
|---|
| 425 | ( 2.5.4.39 NAME 'certificateRevocationList'
|
|---|
| 426 | DESC 'X.509 certificate revocation list'
|
|---|
| 427 | EQUALITY certificateListExactMatch
|
|---|
| 428 | SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )
|
|---|
| 429 |
|
|---|
| 430 | As required by this attribute type's syntax, values of this attribute
|
|---|
| 431 | are requested and transferred using the attribute description
|
|---|
| 432 | "certificateRevocationList;binary".
|
|---|
| 433 |
|
|---|
| 434 | 4.5. authorityRevocationList
|
|---|
| 435 |
|
|---|
| 436 | The authorityRevocationList attribute holds certificate lists, as
|
|---|
| 437 | discussed in 11.2.5 of [X.509].
|
|---|
| 438 |
|
|---|
| 439 | ( 2.5.4.38 NAME 'authorityRevocationList'
|
|---|
| 440 | DESC 'X.509 authority revocation list'
|
|---|
| 441 | EQUALITY certificateListExactMatch
|
|---|
| 442 | SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )
|
|---|
| 443 |
|
|---|
| 444 | As required by this attribute type's syntax, values of this attribute
|
|---|
| 445 | are requested and transferred using the attribute description
|
|---|
| 446 | "authorityRevocationList;binary".
|
|---|
| 447 |
|
|---|
| 448 |
|
|---|
| 449 |
|
|---|
| 450 |
|
|---|
| 451 |
|
|---|
| 452 |
|
|---|
| 453 |
|
|---|
| 454 |
|
|---|
| 455 |
|
|---|
| 456 |
|
|---|
| 457 | Zeilenga Standards Track [Page 8]
|
|---|
| 458 | |
|---|
| 459 |
|
|---|
| 460 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 461 |
|
|---|
| 462 |
|
|---|
| 463 | 4.6. deltaRevocationList
|
|---|
| 464 |
|
|---|
| 465 | The deltaRevocationList attribute holds certificate lists, as
|
|---|
| 466 | discussed in 11.2.6 of [X.509].
|
|---|
| 467 |
|
|---|
| 468 | ( 2.5.4.53 NAME 'deltaRevocationList'
|
|---|
| 469 | DESC 'X.509 delta revocation list'
|
|---|
| 470 | EQUALITY certificateListExactMatch
|
|---|
| 471 | SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )
|
|---|
| 472 |
|
|---|
| 473 | As required by this attribute type's syntax, values of this attribute
|
|---|
| 474 | MUST be requested and transferred using the attribute description
|
|---|
| 475 | "deltaRevocationList;binary".
|
|---|
| 476 |
|
|---|
| 477 | 4.7. supportedAlgorithms
|
|---|
| 478 |
|
|---|
| 479 | The supportedAlgorithms attribute holds supported algorithms, as
|
|---|
| 480 | discussed in 11.2.7 of [X.509].
|
|---|
| 481 |
|
|---|
| 482 | ( 2.5.4.52 NAME 'supportedAlgorithms'
|
|---|
| 483 | DESC 'X.509 supported algorithms'
|
|---|
| 484 | EQUALITY algorithmIdentifierMatch
|
|---|
| 485 | SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 )
|
|---|
| 486 |
|
|---|
| 487 | As required by this attribute type's syntax, values of this attribute
|
|---|
| 488 | MUST be requested and transferred using the attribute description
|
|---|
| 489 | "supportedAlgorithms;binary".
|
|---|
| 490 |
|
|---|
| 491 | 5. Object Classes
|
|---|
| 492 |
|
|---|
| 493 | This section details a set of certificate-related object classes for
|
|---|
| 494 | use in LDAP.
|
|---|
| 495 |
|
|---|
| 496 | 5.1. pkiUser
|
|---|
| 497 |
|
|---|
| 498 | This object class is used in augment entries for objects that may be
|
|---|
| 499 | subject to certificates, as defined in clause 11.1.1 of [X.509].
|
|---|
| 500 |
|
|---|
| 501 | ( 2.5.6.21 NAME 'pkiUser'
|
|---|
| 502 | DESC 'X.509 PKI User'
|
|---|
| 503 | SUP top AUXILIARY
|
|---|
| 504 | MAY userCertificate )
|
|---|
| 505 |
|
|---|
| 506 |
|
|---|
| 507 |
|
|---|
| 508 |
|
|---|
| 509 |
|
|---|
| 510 |
|
|---|
| 511 |
|
|---|
| 512 |
|
|---|
| 513 |
|
|---|
| 514 | Zeilenga Standards Track [Page 9]
|
|---|
| 515 | |
|---|
| 516 |
|
|---|
| 517 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 518 |
|
|---|
| 519 |
|
|---|
| 520 | 5.2. pkiCA
|
|---|
| 521 |
|
|---|
| 522 | This object class is used to augment entries for objects that act as
|
|---|
| 523 | certificate authorities, as defined in clause 11.1.2 of [X.509]
|
|---|
| 524 |
|
|---|
| 525 | ( 2.5.6.22 NAME 'pkiCA'
|
|---|
| 526 | DESC 'X.509 PKI Certificate Authority'
|
|---|
| 527 | SUP top AUXILIARY
|
|---|
| 528 | MAY ( cACertificate $ certificateRevocationList $
|
|---|
| 529 | authorityRevocationList $ crossCertificatePair ) )
|
|---|
| 530 |
|
|---|
| 531 | 5.3. cRLDistributionPoint
|
|---|
| 532 |
|
|---|
| 533 | This class is used to represent objects that act as CRL distribution
|
|---|
| 534 | points, as discussed in clause 11.1.3 of [X.509].
|
|---|
| 535 |
|
|---|
| 536 | ( 2.5.6.19 NAME 'cRLDistributionPoint'
|
|---|
| 537 | DESC 'X.509 CRL distribution point'
|
|---|
| 538 | SUP top STRUCTURAL
|
|---|
| 539 | MUST cn
|
|---|
| 540 | MAY ( certificateRevocationList $
|
|---|
| 541 | authorityRevocationList $ deltaRevocationList ) )
|
|---|
| 542 |
|
|---|
| 543 | 5.4. deltaCRL
|
|---|
| 544 |
|
|---|
| 545 | The deltaCRL object class is used to augment entries to hold delta
|
|---|
| 546 | revocation lists, as discussed in clause 11.1.4 of [X.509].
|
|---|
| 547 |
|
|---|
| 548 | ( 2.5.6.23 NAME 'deltaCRL'
|
|---|
| 549 | DESC 'X.509 delta CRL'
|
|---|
| 550 | SUP top AUXILIARY
|
|---|
| 551 | MAY deltaRevocationList )
|
|---|
| 552 |
|
|---|
| 553 | 5.5. strongAuthenticationUser
|
|---|
| 554 |
|
|---|
| 555 | This object class is used to augment entries for objects
|
|---|
| 556 | participating in certificate-based authentication, as defined in
|
|---|
| 557 | clause 6.15 of [X.521]. This object class is deprecated in favor of
|
|---|
| 558 | pkiUser.
|
|---|
| 559 |
|
|---|
| 560 | ( 2.5.6.15 NAME 'strongAuthenticationUser'
|
|---|
| 561 | DESC 'X.521 strong authentication user'
|
|---|
| 562 | SUP top AUXILIARY
|
|---|
| 563 | MUST userCertificate )
|
|---|
| 564 |
|
|---|
| 565 |
|
|---|
| 566 |
|
|---|
| 567 |
|
|---|
| 568 |
|
|---|
| 569 |
|
|---|
| 570 |
|
|---|
| 571 | Zeilenga Standards Track [Page 10]
|
|---|
| 572 | |
|---|
| 573 |
|
|---|
| 574 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 575 |
|
|---|
| 576 |
|
|---|
| 577 | 5.6. userSecurityInformation
|
|---|
| 578 |
|
|---|
| 579 | This object class is used to augment entries with needed additional
|
|---|
| 580 | associated security information, as defined in clause 6.16 of
|
|---|
| 581 | [X.521].
|
|---|
| 582 |
|
|---|
| 583 | ( 2.5.6.18 NAME 'userSecurityInformation'
|
|---|
| 584 | DESC 'X.521 user security information'
|
|---|
| 585 | SUP top AUXILIARY
|
|---|
| 586 | MAY ( supportedAlgorithms ) )
|
|---|
| 587 |
|
|---|
| 588 | 5.7. certificationAuthority
|
|---|
| 589 |
|
|---|
| 590 | This object class is used to augment entries for objects that act as
|
|---|
| 591 | certificate authorities, as defined in clause 6.17 of [X.521]. This
|
|---|
| 592 | object class is deprecated in favor of pkiCA.
|
|---|
| 593 |
|
|---|
| 594 | ( 2.5.6.16 NAME 'certificationAuthority'
|
|---|
| 595 | DESC 'X.509 certificate authority'
|
|---|
| 596 | SUP top AUXILIARY
|
|---|
| 597 | MUST ( authorityRevocationList $
|
|---|
| 598 | certificateRevocationList $ cACertificate )
|
|---|
| 599 | MAY crossCertificatePair )
|
|---|
| 600 |
|
|---|
| 601 | 5.8. certificationAuthority-V2
|
|---|
| 602 |
|
|---|
| 603 | This object class is used to augment entries for objects that act as
|
|---|
| 604 | certificate authorities, as defined in clause 6.18 of [X.521]. This
|
|---|
| 605 | object class is deprecated in favor of pkiCA.
|
|---|
| 606 |
|
|---|
| 607 | ( 2.5.6.16.2 NAME 'certificationAuthority-V2'
|
|---|
| 608 | DESC 'X.509 certificate authority, version 2'
|
|---|
| 609 | SUP certificationAuthority AUXILIARY
|
|---|
| 610 | MAY deltaRevocationList )
|
|---|
| 611 |
|
|---|
| 612 | 6. Security Considerations
|
|---|
| 613 |
|
|---|
| 614 | General certificate considerations [RFC3280] apply to LDAP-aware
|
|---|
| 615 | certificate applications. General LDAP security considerations
|
|---|
| 616 | [RFC4510] apply as well.
|
|---|
| 617 |
|
|---|
| 618 | While elements of certificate information are commonly signed, these
|
|---|
| 619 | signatures only protect the integrity of the signed information. In
|
|---|
| 620 | the absence of data integrity protections in LDAP (or lower layer,
|
|---|
| 621 | e.g., IPsec), a server is not assured that client certificate request
|
|---|
| 622 | (or other request) was unaltered in transit. Likewise, a client
|
|---|
| 623 | cannot be assured that the results of the query were unaltered in
|
|---|
| 624 |
|
|---|
| 625 |
|
|---|
| 626 |
|
|---|
| 627 |
|
|---|
| 628 | Zeilenga Standards Track [Page 11]
|
|---|
| 629 | |
|---|
| 630 |
|
|---|
| 631 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 632 |
|
|---|
| 633 |
|
|---|
| 634 | transit. Hence, it is generally recommended that implementations
|
|---|
| 635 | make use of authentication and data integrity services in LDAP
|
|---|
| 636 | [RFC4513][RFC4511].
|
|---|
| 637 |
|
|---|
| 638 | 7. IANA Considerations
|
|---|
| 639 |
|
|---|
| 640 | 7.1. Object Identifier Registration
|
|---|
| 641 |
|
|---|
| 642 | The IANA has registered an LDAP Object Identifier [RFC4520] for use
|
|---|
| 643 | in this technical specification.
|
|---|
| 644 |
|
|---|
| 645 | Subject: Request for LDAP OID Registration
|
|---|
| 646 | Person & email address to contact for further information:
|
|---|
| 647 | Kurt Zeilenga <kurt@OpenLDAP.org>
|
|---|
| 648 | Specification: RFC 4523
|
|---|
| 649 | Author/Change Controller: IESG
|
|---|
| 650 | Comments:
|
|---|
| 651 | Identifies the LDAP X.509 Certificate schema elements
|
|---|
| 652 | introduced in this document.
|
|---|
| 653 |
|
|---|
| 654 | 7.2. Descriptor Registration
|
|---|
| 655 |
|
|---|
| 656 | The IANA has updated the LDAP
|
|---|
| 657 | Descriptor registry [RFC44520] as indicated below.
|
|---|
| 658 |
|
|---|
| 659 | Subject: Request for LDAP Descriptor Registration
|
|---|
| 660 | Descriptor (short name): see table
|
|---|
| 661 | Object Identifier: see table
|
|---|
| 662 | Person & email address to contact for further information:
|
|---|
| 663 | Kurt Zeilenga <kurt@OpenLDAP.org>
|
|---|
| 664 | Usage: see table
|
|---|
| 665 | Specification: RFC 4523
|
|---|
| 666 | Author/Change Controller: IESG
|
|---|
| 667 |
|
|---|
| 668 | algorithmIdentifierMatch M 2.5.13.40
|
|---|
| 669 | authorityRevocationList A 2.5.4.38 *
|
|---|
| 670 | cACertificate A 2.5.4.37 *
|
|---|
| 671 | cRLDistributionPoint O 2.5.6.19 *
|
|---|
| 672 | certificateExactMatch M 2.5.13.34
|
|---|
| 673 | certificateListExactMatch M 2.5.13.38
|
|---|
| 674 | certificateListMatch M 2.5.13.39
|
|---|
| 675 | certificateMatch M 2.5.13.35
|
|---|
| 676 | certificatePairExactMatch M 2.5.13.36
|
|---|
| 677 | certificatePairMatch M 2.5.13.37
|
|---|
| 678 | certificateRevocationList A 2.5.4.39 *
|
|---|
| 679 | certificationAuthority O 2.5.6.16 *
|
|---|
| 680 | certificationAuthority-V2 O 2.5.6.16.2 *
|
|---|
| 681 | crossCertificatePair A 2.5.4.40 *
|
|---|
| 682 |
|
|---|
| 683 |
|
|---|
| 684 |
|
|---|
| 685 | Zeilenga Standards Track [Page 12]
|
|---|
| 686 | |
|---|
| 687 |
|
|---|
| 688 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 689 |
|
|---|
| 690 |
|
|---|
| 691 | deltaCRL O 2.5.6.23 *
|
|---|
| 692 | deltaRevocationList A 2.5.4.53 *
|
|---|
| 693 | pkiCA O 2.5.6.22 *
|
|---|
| 694 | pkiUser O 2.5.6.21 *
|
|---|
| 695 | strongAuthenticationUser O 2.5.6.15 *
|
|---|
| 696 | supportedAlgorithms A 2.5.4.52 *
|
|---|
| 697 | userCertificate A 2.5.4.36 *
|
|---|
| 698 | userSecurityInformation O 2.5.6.18 *
|
|---|
| 699 |
|
|---|
| 700 | * Updates previous registration
|
|---|
| 701 |
|
|---|
| 702 | 8. Acknowledgements
|
|---|
| 703 |
|
|---|
| 704 | This document is based on X.509, a product of the ITU-T. A number of
|
|---|
| 705 | LDAP schema definitions were based on those found in RFCs 2252 and
|
|---|
| 706 | 2256, both products of the IETF ASID WG. The ABNF productions in
|
|---|
| 707 | Appendix A were provided by Steven Legg. Additional material was
|
|---|
| 708 | borrowed from prior works by David Chadwick and Steven Legg to refine
|
|---|
| 709 | the LDAP X.509 schema.
|
|---|
| 710 |
|
|---|
| 711 | 9. References
|
|---|
| 712 |
|
|---|
| 713 | 9.1. Normative References
|
|---|
| 714 |
|
|---|
| 715 | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
|
|---|
| 716 | Requirement Levels", BCP 14, RFC 2119, March 1997.
|
|---|
| 717 |
|
|---|
| 718 | [RFC3641] Legg, S., "Generic String Encoding Rules (GSER) for ASN.1
|
|---|
| 719 | Types", RFC 3641, October 2003.
|
|---|
| 720 |
|
|---|
| 721 | [RFC4510] Zeilenga, K., Ed., "Lightweight Directory Access Protocol
|
|---|
| 722 | (LDAP): Technical Specification Road Map", RFC 4510, June
|
|---|
| 723 | 2006.
|
|---|
| 724 |
|
|---|
| 725 | [RFC4512] Zeilenga, K., "Lightweight Directory Access Protocol
|
|---|
| 726 | (LDAP): Directory Information Models", RFC 4512, June
|
|---|
| 727 | 2006.
|
|---|
| 728 |
|
|---|
| 729 | [RFC4522] Legg, S., "Lightweight Directory Access Protocol (LDAP):
|
|---|
| 730 | The Binary Encoding Option", RFC 4522, June 2006.
|
|---|
| 731 |
|
|---|
| 732 | [X.509] International Telecommunication Union - Telecommunication
|
|---|
| 733 | Standardization Sector, "The Directory: Authentication
|
|---|
| 734 | Framework", X.509(2000).
|
|---|
| 735 |
|
|---|
| 736 |
|
|---|
| 737 |
|
|---|
| 738 |
|
|---|
| 739 |
|
|---|
| 740 |
|
|---|
| 741 |
|
|---|
| 742 | Zeilenga Standards Track [Page 13]
|
|---|
| 743 | |
|---|
| 744 |
|
|---|
| 745 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 746 |
|
|---|
| 747 |
|
|---|
| 748 | [X.521] International Telecommunication Union - Telecommunication
|
|---|
| 749 | Standardization Sector, "The Directory: Selected Object
|
|---|
| 750 | Classes", X.521(2000).
|
|---|
| 751 |
|
|---|
| 752 | [X.690] International Telecommunication Union - Telecommunication
|
|---|
| 753 | Standardization Sector, "Specification of ASN.1 encoding
|
|---|
| 754 | rules: Basic Encoding Rules (BER), Canonical Encoding
|
|---|
| 755 | Rules (CER), and Distinguished Encoding Rules (DER)",
|
|---|
| 756 | X.690(2002) (also ISO/IEC 8825-1:2002).
|
|---|
| 757 |
|
|---|
| 758 | 9.2. Informative References
|
|---|
| 759 |
|
|---|
| 760 | [RFC1777] Yeong, W., Howes, T., and S. Kille, "Lightweight Directory
|
|---|
| 761 | Access Protocol", RFC 1777, March 1995.
|
|---|
| 762 |
|
|---|
| 763 | [RFC2156] Kille, S., "MIXER (Mime Internet X.400 Enhanced Relay):
|
|---|
| 764 | Mapping between X.400 and RFC 822/MIME", RFC 2156, January
|
|---|
| 765 | 1998.
|
|---|
| 766 |
|
|---|
| 767 | [RFC3280] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
|
|---|
| 768 | X.509 Public Key Infrastructure Certificate and
|
|---|
| 769 | Certificate Revocation List (CRL) Profile", RFC 3280,
|
|---|
| 770 | April 2002.
|
|---|
| 771 |
|
|---|
| 772 | [RFC3494] Zeilenga, K., "Lightweight Directory Access Protocol
|
|---|
| 773 | version 2 (LDAPv2) to Historic Status", RFC 3494, March
|
|---|
| 774 | 2003.
|
|---|
| 775 |
|
|---|
| 776 | [RFC3642] Legg, S., "Common Elements of Generic String Encoding
|
|---|
| 777 | Rules (GSER) Encodings", RFC 3642, October 2003.
|
|---|
| 778 |
|
|---|
| 779 | [RFC4234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
|
|---|
| 780 | Specifications: ABNF", RFC 4234, October 2005.
|
|---|
| 781 |
|
|---|
| 782 | [RFC4511] Sermersheim, J., Ed., "Lightweight Directory Access
|
|---|
| 783 | Protocol (LDAP): The Protocol", RFC 4511, June 2006.
|
|---|
| 784 |
|
|---|
| 785 | [RFC4513] Harrison, R. Ed., "Lightweight Directory Access Protocol
|
|---|
| 786 | (LDAP): Authentication Methods and Security Mechanisms",
|
|---|
| 787 | RFC 4513, June 2006.
|
|---|
| 788 |
|
|---|
| 789 | [RFC4520] Zeilenga, K., "Internet Assigned Numbers Authority (IANA)
|
|---|
| 790 | Considerations for the Lightweight Directory Access
|
|---|
| 791 | Protocol (LDAP)", BCP 64, RFC 4520, June 2006.
|
|---|
| 792 |
|
|---|
| 793 |
|
|---|
| 794 |
|
|---|
| 795 |
|
|---|
| 796 |
|
|---|
| 797 |
|
|---|
| 798 |
|
|---|
| 799 | Zeilenga Standards Track [Page 14]
|
|---|
| 800 | |
|---|
| 801 |
|
|---|
| 802 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 803 |
|
|---|
| 804 |
|
|---|
| 805 | Appendix A.
|
|---|
| 806 |
|
|---|
| 807 | This appendix is informative.
|
|---|
| 808 |
|
|---|
| 809 | This appendix provides ABNF [RFC4234] grammars for GSER-based
|
|---|
| 810 | [RFC3641] LDAP-specific encodings specified in this document. These
|
|---|
| 811 | grammars where produced using, and relying on, Common Elements for
|
|---|
| 812 | GSER Encodings [RFC3642].
|
|---|
| 813 |
|
|---|
| 814 | A.1. CertificateExactAssertion
|
|---|
| 815 |
|
|---|
| 816 | CertificateExactAssertion = "{" sp cea-serialNumber ","
|
|---|
| 817 | sp cea-issuer sp "}"
|
|---|
| 818 |
|
|---|
| 819 | cea-serialNumber = id-serialNumber msp CertificateSerialNumber
|
|---|
| 820 | cea-issuer = id-issuer msp Name
|
|---|
| 821 |
|
|---|
| 822 | id-serialNumber =
|
|---|
| 823 | %x73.65.72.69.61.6C.4E.75.6D.62.65.72 ; 'serialNumber'
|
|---|
| 824 | id-issuer = %x69.73.73.75.65.72 ; 'issuer'
|
|---|
| 825 |
|
|---|
| 826 | Name = id-rdnSequence ":" RDNSequence
|
|---|
| 827 | id-rdnSequence = %x72.64.6E.53.65.71.75.65.6E.63.65 ; 'rdnSequence'
|
|---|
| 828 |
|
|---|
| 829 | CertificateSerialNumber = INTEGER
|
|---|
| 830 |
|
|---|
| 831 | A.2. CertificateAssertion
|
|---|
| 832 |
|
|---|
| 833 | CertificateAssertion = "{" [ sp ca-serialNumber ]
|
|---|
| 834 | [ sep sp ca-issuer ]
|
|---|
| 835 | [ sep sp ca-subjectKeyIdentifier ]
|
|---|
| 836 | [ sep sp ca-authorityKeyIdentifier ]
|
|---|
| 837 | [ sep sp ca-certificateValid ]
|
|---|
| 838 | [ sep sp ca-privateKeyValid ]
|
|---|
| 839 | [ sep sp ca-subjectPublicKeyAlgID ]
|
|---|
| 840 | [ sep sp ca-keyUsage ]
|
|---|
| 841 | [ sep sp ca-subjectAltName ]
|
|---|
| 842 | [ sep sp ca-policy ]
|
|---|
| 843 | [ sep sp ca-pathToName ]
|
|---|
| 844 | [ sep sp ca-subject ]
|
|---|
| 845 | [ sep sp ca-nameConstraints ] sp "}"
|
|---|
| 846 |
|
|---|
| 847 | ca-serialNumber = id-serialNumber msp CertificateSerialNumber
|
|---|
| 848 | ca-issuer = id-issuer msp Name
|
|---|
| 849 | ca-subjectKeyIdentifier = id-subjectKeyIdentifier msp
|
|---|
| 850 | SubjectKeyIdentifier
|
|---|
| 851 | ca-authorityKeyIdentifier = id-authorityKeyIdentifier msp
|
|---|
| 852 | AuthorityKeyIdentifier
|
|---|
| 853 |
|
|---|
| 854 |
|
|---|
| 855 |
|
|---|
| 856 | Zeilenga Standards Track [Page 15]
|
|---|
| 857 | |
|---|
| 858 |
|
|---|
| 859 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 860 |
|
|---|
| 861 |
|
|---|
| 862 | ca-certificateValid = id-certificateValid msp Time
|
|---|
| 863 | ca-privateKeyValid = id-privateKeyValid msp GeneralizedTime
|
|---|
| 864 | ca-subjectPublicKeyAlgID = id-subjectPublicKeyAlgID msp
|
|---|
| 865 | OBJECT-IDENTIFIER
|
|---|
| 866 | ca-keyUsage = id-keyUsage msp KeyUsage
|
|---|
| 867 | ca-subjectAltName = id-subjectAltName msp AltNameType
|
|---|
| 868 | ca-policy = id-policy msp CertPolicySet
|
|---|
| 869 | ca-pathToName = id-pathToName msp Name
|
|---|
| 870 | ca-subject = id-subject msp Name
|
|---|
| 871 | ca-nameConstraints = id-nameConstraints msp NameConstraintsSyntax
|
|---|
| 872 |
|
|---|
| 873 | id-subjectKeyIdentifier =
|
|---|
| 874 | %x73.75.62.6A.65.63.74.4B.65.79.49.64.65.6E.74.69.66.69.65.72
|
|---|
| 875 | ; 'subjectKeyIdentifier'
|
|---|
| 876 | id-authorityKeyIdentifier =
|
|---|
| 877 | %x61.75.74.68.6F.72.69.74.79.4B.65.79.49.64.65.6E.74.69.66.69.65.72
|
|---|
| 878 | ; 'authorityKeyIdentifier'
|
|---|
| 879 | id-certificateValid = %x63.65.72.74.69.66.69.63.61.74.65.56.61.6C.69.64
|
|---|
| 880 | ; 'certificateValid'
|
|---|
| 881 | id-privateKeyValid = %x70.72.69.76.61.74.65.4B.65.79.56.61.6C.69.64
|
|---|
| 882 | ; 'privateKeyValid'
|
|---|
| 883 | id-subjectPublicKeyAlgID =
|
|---|
| 884 | %x73.75.62.6A.65.63.74.50.75.62.6C.69.63.4B.65.79.41.6C.67.49.44
|
|---|
| 885 | ; 'subjectPublicKeyAlgID'
|
|---|
| 886 | id-keyUsage = %x6B.65.79.55.73.61.67.65 ; 'keyUsage'
|
|---|
| 887 | id-subjectAltName = %x73.75.62.6A.65.63.74.41.6C.74.4E.61.6D.65
|
|---|
| 888 | ; 'subjectAltName'
|
|---|
| 889 | id-policy = %x70.6F.6C.69.63.79 ; 'policy'
|
|---|
| 890 | id-pathToName = %x70.61.74.68.54.6F.4E.61.6D.65 ; 'pathToName'
|
|---|
| 891 | id-subject = %x73.75.62.6A.65.63.74 ; 'subject'
|
|---|
| 892 | id-nameConstraints = %x6E.61.6D.65.43.6F.6E.73.74.72.61.69.6E.74.73
|
|---|
| 893 | ; 'nameConstraints'
|
|---|
| 894 |
|
|---|
| 895 | SubjectKeyIdentifier = KeyIdentifier
|
|---|
| 896 |
|
|---|
| 897 | KeyIdentifier = OCTET-STRING
|
|---|
| 898 |
|
|---|
| 899 | AuthorityKeyIdentifier = "{" [ sp aki-keyIdentifier ]
|
|---|
| 900 | [ sep sp aki-authorityCertIssuer ]
|
|---|
| 901 | [ sep sp aki-authorityCertSerialNumber ] sp "}"
|
|---|
| 902 |
|
|---|
| 903 | aki-keyIdentifier = id-keyIdentifier msp KeyIdentifier
|
|---|
| 904 | aki-authorityCertIssuer = id-authorityCertIssuer msp GeneralNames
|
|---|
| 905 |
|
|---|
| 906 | GeneralNames = "{" sp GeneralName *( "," sp GeneralName ) sp "}"
|
|---|
| 907 | GeneralName = gn-otherName
|
|---|
| 908 | / gn-rfc822Name
|
|---|
| 909 | / gn-dNSName
|
|---|
| 910 |
|
|---|
| 911 |
|
|---|
| 912 |
|
|---|
| 913 | Zeilenga Standards Track [Page 16]
|
|---|
| 914 | |
|---|
| 915 |
|
|---|
| 916 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 917 |
|
|---|
| 918 |
|
|---|
| 919 | / gn-x400Address
|
|---|
| 920 | / gn-directoryName
|
|---|
| 921 | / gn-ediPartyName
|
|---|
| 922 | / gn-uniformResourceIdentifier
|
|---|
| 923 | / gn-iPAddress
|
|---|
| 924 | / gn-registeredID
|
|---|
| 925 |
|
|---|
| 926 | gn-otherName = id-otherName ":" OtherName
|
|---|
| 927 | gn-rfc822Name = id-rfc822Name ":" IA5String
|
|---|
| 928 | gn-dNSName = id-dNSName ":" IA5String
|
|---|
| 929 | gn-x400Address = id-x400Address ":" ORAddress
|
|---|
| 930 | gn-directoryName = id-directoryName ":" Name
|
|---|
| 931 | gn-ediPartyName = id-ediPartyName ":" EDIPartyName
|
|---|
| 932 | gn-iPAddress = id-iPAddress ":" OCTET-STRING
|
|---|
| 933 | gn-registeredID = gn-id-registeredID ":" OBJECT-IDENTIFIER
|
|---|
| 934 |
|
|---|
| 935 | gn-uniformResourceIdentifier = id-uniformResourceIdentifier
|
|---|
| 936 | ":" IA5String
|
|---|
| 937 |
|
|---|
| 938 | id-otherName = %x6F.74.68.65.72.4E.61.6D.65 ; 'otherName'
|
|---|
| 939 | gn-id-registeredID = %x72.65.67.69.73.74.65.72.65.64.49.44
|
|---|
| 940 | ; 'registeredID'
|
|---|
| 941 |
|
|---|
| 942 | OtherName = "{" sp on-type-id "," sp on-value sp "}"
|
|---|
| 943 | on-type-id = id-type-id msp OBJECT-IDENTIFIER
|
|---|
| 944 | on-value = id-value msp Value
|
|---|
| 945 | ;; <Value> as defined in Section 3 of [RFC3641]
|
|---|
| 946 |
|
|---|
| 947 | id-type-id = %x74.79.70.65.2D.69.64 ; 'type-id'
|
|---|
| 948 | id-value = %x76.61.6C.75.65 ; 'value'
|
|---|
| 949 |
|
|---|
| 950 | ORAddress = dquote *SafeIA5Character dquote
|
|---|
| 951 | SafeIA5Character = %x01-21 / %x23-7F / ; ASCII minus dquote
|
|---|
| 952 | dquote dquote ; escaped double quote
|
|---|
| 953 | dquote = %x22 ; '"' (double quote)
|
|---|
| 954 |
|
|---|
| 955 | ;; Note: The <ORAddress> rule encodes the x400Address component
|
|---|
| 956 | ;; of a GeneralName as a character string between double quotes.
|
|---|
| 957 | ;; The character string is first derived according to Section 4.1
|
|---|
| 958 | ;; of [RFC2156], and then any embedded double quotes are escaped
|
|---|
| 959 | ;; by being repeated. This resulting string is output between
|
|---|
| 960 | ;; double quotes.
|
|---|
| 961 |
|
|---|
| 962 | EDIPartyName = "{" [ sp nameAssigner "," ] sp partyName sp "}"
|
|---|
| 963 | nameAssigner = id-nameAssigner msp DirectoryString
|
|---|
| 964 | partyName = id-partyName msp DirectoryString
|
|---|
| 965 | id-nameAssigner = %x6E.61.6D.65.41.73.73.69.67.6E.65.72
|
|---|
| 966 | ; 'nameAssigner'
|
|---|
| 967 |
|
|---|
| 968 |
|
|---|
| 969 |
|
|---|
| 970 | Zeilenga Standards Track [Page 17]
|
|---|
| 971 | |
|---|
| 972 |
|
|---|
| 973 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 974 |
|
|---|
| 975 |
|
|---|
| 976 | id-partyName = %x70.61.72.74.79.4E.61.6D.65 ; 'partyName'
|
|---|
| 977 |
|
|---|
| 978 | aki-authorityCertSerialNumber = id-authorityCertSerialNumber
|
|---|
| 979 | msp CertificateSerialNumber
|
|---|
| 980 |
|
|---|
| 981 | id-keyIdentifier = %x6B.65.79.49.64.65.6E.74.69.66.69.65.72
|
|---|
| 982 | ; 'keyIdentifier'
|
|---|
| 983 | id-authorityCertIssuer =
|
|---|
| 984 | %x61.75.74.68.6F.72.69.74.79.43.65.72.74.49.73.73.75.65.72
|
|---|
| 985 | ; 'authorityCertIssuer'
|
|---|
| 986 |
|
|---|
| 987 | id-authorityCertSerialNumber = %x61.75.74.68.6F.72.69.74.79.43
|
|---|
| 988 | %x65.72.74.53.65.72.69.61.6C.4E.75.6D.62.65.72
|
|---|
| 989 | ; 'authorityCertSerialNumber'
|
|---|
| 990 |
|
|---|
| 991 | Time = time-utcTime / time-generalizedTime
|
|---|
| 992 | time-utcTime = id-utcTime ":" UTCTime
|
|---|
| 993 | time-generalizedTime = id-generalizedTime ":" GeneralizedTime
|
|---|
| 994 | id-utcTime = %x75.74.63.54.69.6D.65 ; 'utcTime'
|
|---|
| 995 | id-generalizedTime = %x67.65.6E.65.72.61.6C.69.7A.65.64.54.69.6D.65
|
|---|
| 996 | ; 'generalizedTime'
|
|---|
| 997 |
|
|---|
| 998 | KeyUsage = BIT-STRING / key-usage-bit-list
|
|---|
| 999 | key-usage-bit-list = "{" [ sp key-usage *( "," sp key-usage ) ] sp "}"
|
|---|
| 1000 |
|
|---|
| 1001 | ;; Note: The <key-usage-bit-list> rule encodes the one bits in
|
|---|
| 1002 | ;; a KeyUsage value as a comma separated list of identifiers.
|
|---|
| 1003 |
|
|---|
| 1004 | key-usage = id-digitalSignature
|
|---|
| 1005 | / id-nonRepudiation
|
|---|
| 1006 | / id-keyEncipherment
|
|---|
| 1007 | / id-dataEncipherment
|
|---|
| 1008 | / id-keyAgreement
|
|---|
| 1009 | / id-keyCertSign
|
|---|
| 1010 | / id-cRLSign
|
|---|
| 1011 | / id-encipherOnly
|
|---|
| 1012 | / id-decipherOnly
|
|---|
| 1013 |
|
|---|
| 1014 | id-digitalSignature = %x64.69.67.69.74.61.6C.53.69.67.6E.61.74
|
|---|
| 1015 | %x75.72.65 ; 'digitalSignature'
|
|---|
| 1016 | id-nonRepudiation = %x6E.6F.6E.52.65.70.75.64.69.61.74.69.6F.6E
|
|---|
| 1017 | ; 'nonRepudiation'
|
|---|
| 1018 | id-keyEncipherment = %x6B.65.79.45.6E.63.69.70.68.65.72.6D.65.6E.74
|
|---|
| 1019 | ; 'keyEncipherment'
|
|---|
| 1020 | id-dataEncipherment = %x64.61.74.61.45.6E.63.69.70.68.65.72.6D.65.6E
|
|---|
| 1021 | %x74 ; "dataEncipherment'
|
|---|
| 1022 | id-keyAgreement = %x6B.65.79.41.67.72.65.65.6D.65.6E.74
|
|---|
| 1023 | ; 'keyAgreement'
|
|---|
| 1024 |
|
|---|
| 1025 |
|
|---|
| 1026 |
|
|---|
| 1027 | Zeilenga Standards Track [Page 18]
|
|---|
| 1028 | |
|---|
| 1029 |
|
|---|
| 1030 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 1031 |
|
|---|
| 1032 |
|
|---|
| 1033 | id-keyCertSign = %x6B.65.79.43.65.72.74.53.69.67.6E
|
|---|
| 1034 | ; 'keyCertSign'
|
|---|
| 1035 | id-cRLSign = %x63.52.4C.53.69.67.6E ; "cRLSign"
|
|---|
| 1036 | id-encipherOnly = %x65.6E.63.69.70.68.65.72.4F.6E.6C.79
|
|---|
| 1037 | ; 'encipherOnly'
|
|---|
| 1038 | id-decipherOnly = %x64.65.63.69.70.68.65.72.4F.6E.6C.79
|
|---|
| 1039 | ; 'decipherOnly'
|
|---|
| 1040 |
|
|---|
| 1041 | AltNameType = ant-builtinNameForm / ant-otherNameForm
|
|---|
| 1042 |
|
|---|
| 1043 | ant-builtinNameForm = id-builtinNameForm ":" BuiltinNameForm
|
|---|
| 1044 | ant-otherNameForm = id-otherNameForm ":" OBJECT-IDENTIFIER
|
|---|
| 1045 |
|
|---|
| 1046 | id-builtinNameForm = %x62.75.69.6C.74.69.6E.4E.61.6D.65.46.6F.72.6D
|
|---|
| 1047 | ; 'builtinNameForm'
|
|---|
| 1048 | id-otherNameForm = %x6F.74.68.65.72.4E.61.6D.65.46.6F.72.6D
|
|---|
| 1049 | ; 'otherNameForm'
|
|---|
| 1050 |
|
|---|
| 1051 | BuiltinNameForm = id-rfc822Name
|
|---|
| 1052 | / id-dNSName
|
|---|
| 1053 | / id-x400Address
|
|---|
| 1054 | / id-directoryName
|
|---|
| 1055 | / id-ediPartyName
|
|---|
| 1056 | / id-uniformResourceIdentifier
|
|---|
| 1057 | / id-iPAddress
|
|---|
| 1058 | / id-registeredId
|
|---|
| 1059 |
|
|---|
| 1060 | id-rfc822Name = %x72.66.63.38.32.32.4E.61.6D.65 ; 'rfc822Name'
|
|---|
| 1061 | id-dNSName = %x64.4E.53.4E.61.6D.65 ; 'dNSName'
|
|---|
| 1062 | id-x400Address = %x78.34.30.30.41.64.64.72.65.73.73 ; 'x400Address'
|
|---|
| 1063 | id-directoryName = %x64.69.72.65.63.74.6F.72.79.4E.61.6D.65
|
|---|
| 1064 | ; 'directoryName'
|
|---|
| 1065 | id-ediPartyName = %x65.64.69.50.61.72.74.79.4E.61.6D.65
|
|---|
| 1066 | ; 'ediPartyName'
|
|---|
| 1067 | id-iPAddress = %x69.50.41.64.64.72.65.73.73 ; 'iPAddress'
|
|---|
| 1068 | id-registeredId = %x72.65.67.69.73.74.65.72.65.64.49.64
|
|---|
| 1069 | ; 'registeredId'
|
|---|
| 1070 |
|
|---|
| 1071 | id-uniformResourceIdentifier = %x75.6E.69.66.6F.72.6D.52.65.73.6F.75
|
|---|
| 1072 | %x72.63.65.49.64.65.6E.74.69.66.69.65.72
|
|---|
| 1073 | ; 'uniformResourceIdentifier'
|
|---|
| 1074 |
|
|---|
| 1075 | CertPolicySet = "{" sp CertPolicyId *( "," sp CertPolicyId ) sp "}"
|
|---|
| 1076 | CertPolicyId = OBJECT-IDENTIFIER
|
|---|
| 1077 |
|
|---|
| 1078 | NameConstraintsSyntax = "{" [ sp ncs-permittedSubtrees ]
|
|---|
| 1079 | [ sep sp ncs-excludedSubtrees ] sp "}"
|
|---|
| 1080 |
|
|---|
| 1081 |
|
|---|
| 1082 |
|
|---|
| 1083 |
|
|---|
| 1084 | Zeilenga Standards Track [Page 19]
|
|---|
| 1085 | |
|---|
| 1086 |
|
|---|
| 1087 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 1088 |
|
|---|
| 1089 |
|
|---|
| 1090 | ncs-permittedSubtrees = id-permittedSubtrees msp GeneralSubtrees
|
|---|
| 1091 | ncs-excludedSubtrees = id-excludedSubtrees msp GeneralSubtrees
|
|---|
| 1092 |
|
|---|
| 1093 | id-permittedSubtrees =
|
|---|
| 1094 | %x70.65.72.6D.69.74.74.65.64.53.75.62.74.72.65.65.73
|
|---|
| 1095 | ; 'permittedSubtrees'
|
|---|
| 1096 | id-excludedSubtrees =
|
|---|
| 1097 | %x65.78.63.6C.75.64.65.64.53.75.62.74.72.65.65.73
|
|---|
| 1098 | ; 'excludedSubtrees'
|
|---|
| 1099 |
|
|---|
| 1100 | GeneralSubtrees = "{" sp GeneralSubtree
|
|---|
| 1101 | *( "," sp GeneralSubtree ) sp "}"
|
|---|
| 1102 | GeneralSubtree = "{" sp gs-base
|
|---|
| 1103 | [ "," sp gs-minimum ]
|
|---|
| 1104 | [ "," sp gs-maximum ] sp "}"
|
|---|
| 1105 |
|
|---|
| 1106 | gs-base = id-base msp GeneralName
|
|---|
| 1107 | gs-minimum = id-minimum msp BaseDistance
|
|---|
| 1108 | gs-maximum = id-maximum msp BaseDistance
|
|---|
| 1109 |
|
|---|
| 1110 | id-base = %x62.61.73.65 ; 'base'
|
|---|
| 1111 | id-minimum = %x6D.69.6E.69.6D.75.6D ; 'minimum'
|
|---|
| 1112 | id-maximum = %x6D.61.78.69.6D.75.6D ; 'maximum'
|
|---|
| 1113 |
|
|---|
| 1114 | BaseDistance = INTEGER-0-MAX
|
|---|
| 1115 |
|
|---|
| 1116 | A.3. CertificatePairExactAssertion
|
|---|
| 1117 |
|
|---|
| 1118 | CertificatePairExactAssertion = "{" [ sp cpea-issuedTo ]
|
|---|
| 1119 | [sep sp cpea-issuedBy ] sp "}"
|
|---|
| 1120 | ;; At least one of <cpea-issuedTo> or <cpea-issuedBy> MUST be present.
|
|---|
| 1121 |
|
|---|
| 1122 | cpea-issuedTo = id-issuedToThisCAAssertion msp
|
|---|
| 1123 | CertificateExactAssertion
|
|---|
| 1124 | cpea-issuedBy = id-issuedByThisCAAssertion msp
|
|---|
| 1125 | CertificateExactAssertion
|
|---|
| 1126 |
|
|---|
| 1127 | id-issuedToThisCAAssertion = %x69.73.73.75.65.64.54.6F.54.68.69.73
|
|---|
| 1128 | %x43.41.41.73.73.65.72.74.69.6F.6E ; 'issuedToThisCAAssertion'
|
|---|
| 1129 | id-issuedByThisCAAssertion = %x69.73.73.75.65.64.42.79.54.68.69.73
|
|---|
| 1130 | %x43.41.41.73.73.65.72.74.69.6F.6E ; 'issuedByThisCAAssertion'
|
|---|
| 1131 |
|
|---|
| 1132 |
|
|---|
| 1133 |
|
|---|
| 1134 |
|
|---|
| 1135 |
|
|---|
| 1136 |
|
|---|
| 1137 |
|
|---|
| 1138 |
|
|---|
| 1139 |
|
|---|
| 1140 |
|
|---|
| 1141 | Zeilenga Standards Track [Page 20]
|
|---|
| 1142 | |
|---|
| 1143 |
|
|---|
| 1144 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 1145 |
|
|---|
| 1146 |
|
|---|
| 1147 | A.4. CertificatePairAssertion
|
|---|
| 1148 |
|
|---|
| 1149 | CertificatePairAssertion = "{" [ sp cpa-issuedTo ]
|
|---|
| 1150 | [sep sp cpa-issuedBy ] sp "}"
|
|---|
| 1151 | ;; At least one of <cpa-issuedTo> and <cpa-issuedBy> MUST be present.
|
|---|
| 1152 |
|
|---|
| 1153 | cpa-issuedTo = id-issuedToThisCAAssertion msp CertificateAssertion
|
|---|
| 1154 | cpa-issuedBy = id-issuedByThisCAAssertion msp CertificateAssertion
|
|---|
| 1155 |
|
|---|
| 1156 | A.5. CertificateListExactAssertion
|
|---|
| 1157 |
|
|---|
| 1158 | CertificateListExactAssertion = "{" sp clea-issuer ","
|
|---|
| 1159 | sp clea-thisUpdate
|
|---|
| 1160 | [ "," sp clea-distributionPoint ] sp "}"
|
|---|
| 1161 |
|
|---|
| 1162 | clea-issuer = id-issuer msp Name
|
|---|
| 1163 | clea-thisUpdate = id-thisUpdate msp Time
|
|---|
| 1164 | clea-distributionPoint = id-distributionPoint msp
|
|---|
| 1165 | DistributionPointName
|
|---|
| 1166 |
|
|---|
| 1167 | id-thisUpdate = %x74.68.69.73.55.70.64.61.74.65 ; 'thisUpdate'
|
|---|
| 1168 | id-distributionPoint =
|
|---|
| 1169 | %x64.69.73.74.72.69.62.75.74.69.6F.6E.50.6F.69.6E.74
|
|---|
| 1170 | ; 'distributionPoint'
|
|---|
| 1171 |
|
|---|
| 1172 | DistributionPointName = dpn-fullName / dpn-nameRelativeToCRLIssuer
|
|---|
| 1173 |
|
|---|
| 1174 | dpn-fullName = id-fullName ":" GeneralNames
|
|---|
| 1175 | dpn-nameRelativeToCRLIssuer = id-nameRelativeToCRLIssuer ":"
|
|---|
| 1176 | RelativeDistinguishedName
|
|---|
| 1177 |
|
|---|
| 1178 | id-fullName = %x66.75.6C.6C.4E.61.6D.65 ; 'fullName'
|
|---|
| 1179 | id-nameRelativeToCRLIssuer = %x6E.61.6D.65.52.65.6C.61.74.69.76.65
|
|---|
| 1180 | %x54.6F.43.52.4C.49.73.73.75.65.72 ; 'nameRelativeToCRLIssuer'
|
|---|
| 1181 |
|
|---|
| 1182 | A.6. CertificateListAssertion
|
|---|
| 1183 |
|
|---|
| 1184 | CertificateListAssertion = "{" [ sp cla-issuer ]
|
|---|
| 1185 | [ sep sp cla-minCRLNumber ]
|
|---|
| 1186 | [ sep sp cla-maxCRLNumber ]
|
|---|
| 1187 | [ sep sp cla-reasonFlags ]
|
|---|
| 1188 | [ sep sp cla-dateAndTime ]
|
|---|
| 1189 | [ sep sp cla-distributionPoint ]
|
|---|
| 1190 | [ sep sp cla-authorityKeyIdentifier ] sp "}"
|
|---|
| 1191 |
|
|---|
| 1192 | cla-issuer = id-issuer msp Name
|
|---|
| 1193 | cla-minCRLNumber = id-minCRLNumber msp CRLNumber
|
|---|
| 1194 | cla-maxCRLNumber = id-maxCRLNumber msp CRLNumber
|
|---|
| 1195 |
|
|---|
| 1196 |
|
|---|
| 1197 |
|
|---|
| 1198 | Zeilenga Standards Track [Page 21]
|
|---|
| 1199 | |
|---|
| 1200 |
|
|---|
| 1201 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 1202 |
|
|---|
| 1203 |
|
|---|
| 1204 | cla-reasonFlags = id-reasonFlags msp ReasonFlags
|
|---|
| 1205 | cla-dateAndTime = id-dateAndTime msp Time
|
|---|
| 1206 |
|
|---|
| 1207 | cla-distributionPoint = id-distributionPoint msp
|
|---|
| 1208 | DistributionPointName
|
|---|
| 1209 |
|
|---|
| 1210 | cla-authorityKeyIdentifier = id-authorityKeyIdentifier msp
|
|---|
| 1211 | AuthorityKeyIdentifier
|
|---|
| 1212 |
|
|---|
| 1213 | id-minCRLNumber = %x6D.69.6E.43.52.4C.4E.75.6D.62.65.72
|
|---|
| 1214 | ; 'minCRLNumber'
|
|---|
| 1215 | id-maxCRLNumber = %x6D.61.78.43.52.4C.4E.75.6D.62.65.72
|
|---|
| 1216 | ; 'maxCRLNumber'
|
|---|
| 1217 | id-reasonFlags = %x72.65.61.73.6F.6E.46.6C.61.67.73 ; 'reasonFlags'
|
|---|
| 1218 | id-dateAndTime = %x64.61.74.65.41.6E.64.54.69.6D.65 ; 'dateAndTime'
|
|---|
| 1219 |
|
|---|
| 1220 | CRLNumber = INTEGER-0-MAX
|
|---|
| 1221 |
|
|---|
| 1222 | ReasonFlags = BIT-STRING
|
|---|
| 1223 | / "{" [ sp reason-flag *( "," sp reason-flag ) ] sp "}"
|
|---|
| 1224 |
|
|---|
| 1225 | reason-flag = id-unused
|
|---|
| 1226 | / id-keyCompromise
|
|---|
| 1227 | / id-cACompromise
|
|---|
| 1228 | / id-affiliationChanged
|
|---|
| 1229 | / id-superseded
|
|---|
| 1230 | / id-cessationOfOperation
|
|---|
| 1231 | / id-certificateHold
|
|---|
| 1232 | / id-privilegeWithdrawn
|
|---|
| 1233 | / id-aACompromise
|
|---|
| 1234 |
|
|---|
| 1235 | id-unused = %x75.6E.75.73.65.64 ; 'unused'
|
|---|
| 1236 | id-keyCompromise = %x6B.65.79.43.6F.6D.70.72.6F.6D.69.73.65
|
|---|
| 1237 | ; 'keyCompromise'
|
|---|
| 1238 | id-cACompromise = %x63.41.43.6F.6D.70.72.6F.6D.69.73.65
|
|---|
| 1239 | ; 'cACompromise'
|
|---|
| 1240 | id-affiliationChanged =
|
|---|
| 1241 | %x61.66.66.69.6C.69.61.74.69.6F.6E.43.68.61.6E.67.65.64
|
|---|
| 1242 | ; 'affiliationChanged'
|
|---|
| 1243 | id-superseded = %x73.75.70.65.72.73.65.64.65.64 ; 'superseded'
|
|---|
| 1244 | id-cessationOfOperation =
|
|---|
| 1245 | %x63.65.73.73.61.74.69.6F.6E.4F.66.4F.70.65.72.61.74.69.6F.6E
|
|---|
| 1246 | ; 'cessationOfOperation'
|
|---|
| 1247 | id-certificateHold = %x63.65.72.74.69.66.69.63.61.74.65.48.6F.6C.64
|
|---|
| 1248 | ; 'certificateHold'
|
|---|
| 1249 | id-privilegeWithdrawn =
|
|---|
| 1250 | %x70.72.69.76.69.6C.65.67.65.57.69.74.68.64.72.61.77.6E
|
|---|
| 1251 | ; 'privilegeWithdrawn'
|
|---|
| 1252 |
|
|---|
| 1253 |
|
|---|
| 1254 |
|
|---|
| 1255 | Zeilenga Standards Track [Page 22]
|
|---|
| 1256 | |
|---|
| 1257 |
|
|---|
| 1258 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 1259 |
|
|---|
| 1260 |
|
|---|
| 1261 | id-aACompromise = %x61.41.43.6F.6D.70.72.6F.6D.69.73.65
|
|---|
| 1262 | ; 'aACompromise'
|
|---|
| 1263 |
|
|---|
| 1264 | A.7. AlgorithmIdentifier
|
|---|
| 1265 |
|
|---|
| 1266 | AlgorithmIdentifier = "{" sp ai-algorithm
|
|---|
| 1267 | [ "," sp ai-parameters ] sp "}"
|
|---|
| 1268 |
|
|---|
| 1269 | ai-algorithm = id-algorithm msp OBJECT-IDENTIFIER
|
|---|
| 1270 | ai-parameters = id-parameters msp Value
|
|---|
| 1271 | id-algorithm = %x61.6C.67.6F.72.69.74.68.6D ; 'algorithm'
|
|---|
| 1272 | id-parameters = %x70.61.72.61.6D.65.74.65.72.73 ; 'parameters'
|
|---|
| 1273 |
|
|---|
| 1274 | Author's Address
|
|---|
| 1275 |
|
|---|
| 1276 | Kurt D. Zeilenga
|
|---|
| 1277 | OpenLDAP Foundation
|
|---|
| 1278 |
|
|---|
| 1279 | EMail: Kurt@OpenLDAP.org
|
|---|
| 1280 |
|
|---|
| 1281 |
|
|---|
| 1282 |
|
|---|
| 1283 |
|
|---|
| 1284 |
|
|---|
| 1285 |
|
|---|
| 1286 |
|
|---|
| 1287 |
|
|---|
| 1288 |
|
|---|
| 1289 |
|
|---|
| 1290 |
|
|---|
| 1291 |
|
|---|
| 1292 |
|
|---|
| 1293 |
|
|---|
| 1294 |
|
|---|
| 1295 |
|
|---|
| 1296 |
|
|---|
| 1297 |
|
|---|
| 1298 |
|
|---|
| 1299 |
|
|---|
| 1300 |
|
|---|
| 1301 |
|
|---|
| 1302 |
|
|---|
| 1303 |
|
|---|
| 1304 |
|
|---|
| 1305 |
|
|---|
| 1306 |
|
|---|
| 1307 |
|
|---|
| 1308 |
|
|---|
| 1309 |
|
|---|
| 1310 |
|
|---|
| 1311 |
|
|---|
| 1312 | Zeilenga Standards Track [Page 23]
|
|---|
| 1313 | |
|---|
| 1314 |
|
|---|
| 1315 | RFC 4523 LDAP X.509 Schema June 2006
|
|---|
| 1316 |
|
|---|
| 1317 |
|
|---|
| 1318 | Full Copyright Statement
|
|---|
| 1319 |
|
|---|
| 1320 | Copyright (C) The Internet Society (2006).
|
|---|
| 1321 |
|
|---|
| 1322 | This document is subject to the rights, licenses and restrictions
|
|---|
| 1323 | contained in BCP 78, and except as set forth therein, the authors
|
|---|
| 1324 | retain all their rights.
|
|---|
| 1325 |
|
|---|
| 1326 | This document and the information contained herein are provided on an
|
|---|
| 1327 | "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
|
|---|
| 1328 | OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
|
|---|
| 1329 | ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
|
|---|
| 1330 | INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
|
|---|
| 1331 | INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
|
|---|
| 1332 | WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
|
|---|
| 1333 |
|
|---|
| 1334 | Intellectual Property
|
|---|
| 1335 |
|
|---|
| 1336 | The IETF takes no position regarding the validity or scope of any
|
|---|
| 1337 | Intellectual Property Rights or other rights that might be claimed to
|
|---|
| 1338 | pertain to the implementation or use of the technology described in
|
|---|
| 1339 | this document or the extent to which any license under such rights
|
|---|
| 1340 | might or might not be available; nor does it represent that it has
|
|---|
| 1341 | made any independent effort to identify any such rights. Information
|
|---|
| 1342 | on the procedures with respect to rights in RFC documents can be
|
|---|
| 1343 | found in BCP 78 and BCP 79.
|
|---|
| 1344 |
|
|---|
| 1345 | Copies of IPR disclosures made to the IETF Secretariat and any
|
|---|
| 1346 | assurances of licenses to be made available, or the result of an
|
|---|
| 1347 | attempt made to obtain a general license or permission for the use of
|
|---|
| 1348 | such proprietary rights by implementers or users of this
|
|---|
| 1349 | specification can be obtained from the IETF on-line IPR repository at
|
|---|
| 1350 | http://www.ietf.org/ipr.
|
|---|
| 1351 |
|
|---|
| 1352 | The IETF invites any interested party to bring to its attention any
|
|---|
| 1353 | copyrights, patents or patent applications, or other proprietary
|
|---|
| 1354 | rights that may cover technology that may be required to implement
|
|---|
| 1355 | this standard. Please address the information to the IETF at
|
|---|
| 1356 | ietf-ipr@ietf.org.
|
|---|
| 1357 |
|
|---|
| 1358 | Acknowledgement
|
|---|
| 1359 |
|
|---|
| 1360 | Funding for the RFC Editor function is provided by the IETF
|
|---|
| 1361 | Administrative Support Activity (IASA).
|
|---|
| 1362 |
|
|---|
| 1363 |
|
|---|
| 1364 |
|
|---|
| 1365 |
|
|---|
| 1366 |
|
|---|
| 1367 |
|
|---|
| 1368 |
|
|---|
| 1369 | Zeilenga Standards Track [Page 24]
|
|---|
| 1370 | |
|---|
| 1371 |
|
|---|
