aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/doc/rfc/rfc4523.txt
diff options
context:
space:
mode:
authorDavid M. Syzdek <david@syzdek.net>2019-11-19 20:15:54 -0900
committerDavid M. Syzdek <david@syzdek.net>2019-11-19 20:15:54 -0900
commit93a84657fb7b8da29cc95a5050329eb164d2b857 (patch)
tree5e66ab79f7e2bed27863e3cf7fff0bd0ef18364d /doc/rfc/rfc4523.txt
parentc145e2919e8dcee00c3cf0a974c2fe6a4106a96b (diff)
downloadldap-utils-93a84657fb7b8da29cc95a5050329eb164d2b857.tar.gz
ldap-utils-93a84657fb7b8da29cc95a5050329eb164d2b857.tar.bz2
ldap-utils-93a84657fb7b8da29cc95a5050329eb164d2b857.tar.xz
ldap-utils-93a84657fb7b8da29cc95a5050329eb164d2b857.zip
oidspecs: adding OID specifications from RFC4523
Diffstat (limited to '')
-rw-r--r--doc/rfc/rfc4523.txt1347
1 files changed, 1347 insertions, 0 deletions
diff --git a/doc/rfc/rfc4523.txt b/doc/rfc/rfc4523.txt
new file mode 100644
index 0000000..d258981
--- /dev/null
+++ b/doc/rfc/rfc4523.txt
@@ -0,0 +1,1347 @@
1
2
3
4
5
6
7Network Working Group K. Zeilenga
8Request for Comments: 4523 OpenLDAP Foundation
9Obsoletes: 2252, 2256, 2587 June 2006
10Category: Standards Track
11
12
13 Lightweight Directory Access Protocol (LDAP)
14 Schema Definitions for X.509 Certificates
15
16Status of This Memo
17
18 This document specifies an Internet standards track protocol for the
19 Internet community, and requests discussion and suggestions for
20 improvements. Please refer to the current edition of the "Internet
21 Official Protocol Standards" (STD 1) for the standardization state
22 and status of this protocol. Distribution of this memo is unlimited.
23
24Copyright Notice
25
26 Copyright (C) The Internet Society (2006).
27
28 Abstract
29
30 This document describes schema for representing X.509 certificates,
31 X.521 security information, and related elements in directories
32 accessible using the Lightweight Directory Access Protocol (LDAP).
33 The LDAP definitions for these X.509 and X.521 schema elements
34 replace those provided in RFCs 2252 and 2256.
35
361. Introduction
37
38 This document provides LDAP [RFC4510] schema definitions [RFC4512]
39 for a subset of elements specified in X.509 [X.509] and X.521
40 [X.521], including attribute types for certificates, cross
41 certificate pairs, and certificate revocation lists; matching rules
42 to be used with these attribute types; and related object classes.
43 LDAP syntax definitions are also provided for associated assertion
44 and attribute values.
45
46 As the semantics of these elements are as defined in X.509 and X.521,
47 knowledge of X.509 and X.521 is necessary to make use of the LDAP
48 schema definitions provided herein.
49
50 This document, together with [RFC4510], obsoletes RFCs 2252 and 2256
51 in their entirety. The changes (in this document) made since RFC
52 2252 and RFC 2256 include:
53
54 - addition of pkiUser, pkiCA, and deltaCRL classes;
55
56
57
58Zeilenga Standards Track [Page 1]
59
60RFC 4523 LDAP X.509 Schema June 2006
61
62
63 - update of attribute types to include equality matching rules in
64 accordance with their X.500 specifications;
65
66 - addition of certificate, certificate pair, certificate list,
67 and algorithm identifier matching rules; and
68
69 - addition of LDAP syntax for assertion syntaxes for these
70 matching rules.
71
72 This document obsoletes RFC 2587. The X.509 schema descriptions for
73 LDAPv2 [RFC1777] are Historic, as is LDAPv2 [RFC3494].
74
75 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
76 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
77 document are to be interpreted as described in BCP 14 [RFC2119].
78
79 Schema definitions are provided using LDAP description formats
80 [RFC4512]. Definitions provided here are formatted (line wrapped)
81 for readability.
82
832. Syntaxes
84
85 This section describes various syntaxes used in LDAP to transfer
86 certificates and related data types.
87
882.1. Certificate
89
90 ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'X.509 Certificate' )
91
92 A value of this syntax is an X.509 Certificate [X.509, clause 7].
93
94 Due to changes made to the definition of a Certificate through time,
95 no LDAP-specific encoding is defined for this syntax. Values of this
96 syntax SHOULD be encoded using Distinguished Encoding Rules (DER)
97 [X.690] and MUST only be transferred using the ;binary transfer
98 option [RFC4522]; that is, by requesting and returning values using
99 attribute descriptions such as "userCertificate;binary".
100
101 As values of this syntax contain digitally signed data, values of
102 this syntax and the form of each value MUST be preserved as
103 presented.
104
1052.2. CertificateList
106
107 ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'X.509 Certificate List' )
108
109 A value of this syntax is an X.509 CertificateList [X.509, clause
110 7.3].
111
112
113
114Zeilenga Standards Track [Page 2]
115
116RFC 4523 LDAP X.509 Schema June 2006
117
118
119 Due to changes made to the definition of a CertificateList through
120 time, no LDAP-specific encoding is defined for this syntax. Values
121 of this syntax SHOULD be encoded using DER [X.690] and MUST only be
122 transferred using the ;binary transfer option [RFC4522]; that is, by
123 requesting and returning values using attribute descriptions such as
124 "certificateRevocationList;binary".
125
126 As values of this syntax contain digitally signed data, values of
127 this syntax and the form of each value MUST be preserved as
128 presented.
129
1302.3. CertificatePair
131
132 ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'X.509 Certificate Pair' )
133
134 A value of this syntax is an X.509 CertificatePair [X.509, clause
135 11.2.3].
136
137 Due to changes made to the definition of an X.509 CertificatePair
138 through time, no LDAP-specific encoding is defined for this syntax.
139 Values of this syntax SHOULD be encoded using DER [X.690] and MUST
140 only be transferred using the ;binary transfer option [RFC4522]; that
141 is, by requesting and returning values using attribute descriptions
142 such as "crossCertificatePair;binary".
143
144 As values of this syntax contain digitally signed data, values of
145 this syntax and the form of each value MUST be preserved as
146 presented.
147
1482.4. SupportedAlgorithm
149
150 ( 1.3.6.1.4.1.1466.115.121.1.49
151 DESC 'X.509 Supported Algorithm' )
152
153 A value of this syntax is an X.509 SupportedAlgorithm [X.509, clause
154 11.2.7].
155
156 Due to changes made to the definition of an X.509 SupportedAlgorithm
157 through time, no LDAP-specific encoding is defined for this syntax.
158 Values of this syntax SHOULD be encoded using DER [X.690] and MUST
159 only be transferred using the ;binary transfer option [RFC4522]; that
160 is, by requesting and returning values using attribute descriptions
161 such as "supportedAlgorithms;binary".
162
163 As values of this syntax contain digitally signed data, values of
164 this syntax and the form of the value MUST be preserved as presented.
165
166
167
168
169
170Zeilenga Standards Track [Page 3]
171
172RFC 4523 LDAP X.509 Schema June 2006
173
174
1752.5. CertificateExactAssertion
176
177 ( 1.3.6.1.1.15.1 DESC 'X.509 Certificate Exact Assertion' )
178
179 A value of this syntax is an X.509 CertificateExactAssertion [X.509,
180 clause 11.3.1]. Values of this syntax MUST be encoded using the
181 Generic String Encoding Rules (GSER) [RFC3641]. Appendix A.1
182 provides an equivalent Augmented Backus-Naur Form (ABNF) [RFC4234]
183 grammar for this syntax.
184
1852.6. CertificateAssertion
186
187 ( 1.3.6.1.1.15.2 DESC 'X.509 Certificate Assertion' )
188
189 A value of this syntax is an X.509 CertificateAssertion [X.509,
190 clause 11.3.2]. Values of this syntax MUST be encoded using GSER
191 [RFC3641]. Appendix A.2 provides an equivalent ABNF [RFC4234]
192 grammar for this syntax.
193
1942.7. CertificatePairExactAssertion
195
196 ( 1.3.6.1.1.15.3
197 DESC 'X.509 Certificate Pair Exact Assertion' )
198
199 A value of this syntax is an X.509 CertificatePairExactAssertion
200 [X.509, clause 11.3.3]. Values of this syntax MUST be encoded using
201 GSER [RFC3641]. Appendix A.3 provides an equivalent ABNF [RFC4234]
202 grammar for this syntax.
203
2042.8. CertificatePairAssertion
205
206 ( 1.3.6.1.1.15.4 DESC 'X.509 Certificate Pair Assertion' )
207
208 A value of this syntax is an X.509 CertificatePairAssertion [X.509,
209 clause 11.3.4]. Values of this syntax MUST be encoded using GSER
210 [RFC3641]. Appendix A.4 provides an equivalent ABNF [RFC4234]
211 grammar for this syntax.
212
2132.9. CertificateListExactAssertion
214
215 ( 1.3.6.1.1.15.5
216 DESC 'X.509 Certificate List Exact Assertion' )
217
218 A value of this syntax is an X.509 CertificateListExactAssertion
219 [X.509, clause 11.3.5]. Values of this syntax MUST be encoded using
220 GSER [RFC3641]. Appendix A.5 provides an equivalent ABNF grammar for
221 this syntax.
222
223
224
225
226Zeilenga Standards Track [Page 4]
227
228RFC 4523 LDAP X.509 Schema June 2006
229
230
2312.10. CertificateListAssertion
232
233 ( 1.3.6.1.1.15.6 DESC 'X.509 Certificate List Assertion' )
234
235 A value of this syntax is an X.509 CertificateListAssertion [X.509,
236 clause 11.3.6]. Values of this syntax MUST be encoded using GSER
237 [RFC3641]. Appendix A.6 provides an equivalent ABNF [RFC4234]
238 grammar for this syntax.
239
2402.11. AlgorithmIdentifier
241
242 ( 1.3.6.1.1.15.7 DESC 'X.509 Algorithm Identifier' )
243
244 A value of this syntax is an X.509 AlgorithmIdentifier [X.509, Clause
245 7]. Values of this syntax MUST be encoded using GSER [RFC3641].
246
247 Appendix A.7 provides an equivalent ABNF [RFC4234] grammar for this
248 syntax.
249
2503. Matching Rules
251
252 This section introduces a set of certificate and related matching
253 rules for use in LDAP. These rules are intended to act in accordance
254 with their X.500 counterparts.
255
2563.1. certificateExactMatch
257
258 The certificateExactMatch matching rule compares the presented
259 certificate exact assertion value with an attribute value of the
260 certificate syntax as described in clause 11.3.1 of [X.509].
261
262 ( 2.5.13.34 NAME 'certificateExactMatch'
263 DESC 'X.509 Certificate Exact Match'
264 SYNTAX 1.3.6.1.1.15.1 )
265
2663.2. certificateMatch
267
268 The certificateMatch matching rule compares the presented certificate
269 assertion value with an attribute value of the certificate syntax as
270 described in clause 11.3.2 of [X.509].
271
272 ( 2.5.13.35 NAME 'certificateMatch'
273 DESC 'X.509 Certificate Match'
274 SYNTAX 1.3.6.1.1.15.2 )
275
276
277
278
279
280
281
282Zeilenga Standards Track [Page 5]
283
284RFC 4523 LDAP X.509 Schema June 2006
285
286
2873.3. certificatePairExactMatch
288
289 The certificatePairExactMatch matching rule compares the presented
290 certificate pair exact assertion value with an attribute value of the
291 certificate pair syntax as described in clause 11.3.3 of [X.509].
292
293 ( 2.5.13.36 NAME 'certificatePairExactMatch'
294 DESC 'X.509 Certificate Pair Exact Match'
295 SYNTAX 1.3.6.1.1.15.3 )
296
2973.4. certificatePairMatch
298
299 The certificatePairMatch matching rule compares the presented
300 certificate pair assertion value with an attribute value of the
301 certificate pair syntax as described in clause 11.3.4 of [X.509].
302
303 ( 2.5.13.37 NAME 'certificatePairMatch'
304 DESC 'X.509 Certificate Pair Match'
305 SYNTAX 1.3.6.1.1.15.4 )
306
3073.5. certificateListExactMatch
308
309 The certificateListExactMatch matching rule compares the presented
310 certificate list exact assertion value with an attribute value of the
311 certificate pair syntax as described in clause 11.3.5 of [X.509].
312
313 ( 2.5.13.38 NAME 'certificateListExactMatch'
314 DESC 'X.509 Certificate List Exact Match'
315 SYNTAX 1.3.6.1.1.15.5 )
316
3173.6. certificateListMatch
318
319 The certificateListMatch matching rule compares the presented
320 certificate list assertion value with an attribute value of the
321 certificate pair syntax as described in clause 11.3.6 of [X.509].
322
323 ( 2.5.13.39 NAME 'certificateListMatch'
324 DESC 'X.509 Certificate List Match'
325 SYNTAX 1.3.6.1.1.15.6 )
326
327
328
329
330
331
332
333
334
335
336
337
338Zeilenga Standards Track [Page 6]
339
340RFC 4523 LDAP X.509 Schema June 2006
341
342
3433.7. algorithmIdentifierMatch
344
345 The algorithmIdentifierMatch mating rule compares a presented
346 algorithm identifier with an attribute value of the supported
347 algorithm as described in clause 11.3.7 of [X.509].
348
349 ( 2.5.13.40 NAME 'algorithmIdentifier'
350 DESC 'X.509 Algorithm Identifier Match'
351 SYNTAX 1.3.6.1.1.15.7 )
352
3534. Attribute Types
354
355 This section details a set of certificate and related attribute types
356 for use in LDAP.
357
3584.1. userCertificate
359
360 The userCertificate attribute holds the X.509 certificates issued to
361 the user by one or more certificate authorities, as discussed in
362 clause 11.2.1 of [X.509].
363
364 ( 2.5.4.36 NAME 'userCertificate'
365 DESC 'X.509 user certificate'
366 EQUALITY certificateExactMatch
367 SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )
368
369 As required by this attribute type's syntax, values of this attribute
370 are requested and transferred using the attribute description
371 "userCertificate;binary".
372
3734.2. cACertificate
374
375 The cACertificate attribute holds the X.509 certificates issued to
376 the certificate authority (CA), as discussed in clause 11.2.2 of
377 [X.509].
378
379 ( 2.5.4.37 NAME 'cACertificate'
380 DESC 'X.509 CA certificate'
381 EQUALITY certificateExactMatch
382 SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )
383
384 As required by this attribute type's syntax, values of this attribute
385 are requested and transferred using the attribute description
386 "cACertificate;binary".
387
388
389
390
391
392
393
394Zeilenga Standards Track [Page 7]
395
396RFC 4523 LDAP X.509 Schema June 2006
397
398
3994.3. crossCertificatePair
400
401 The crossCertificatePair attribute holds an X.509 certificate pair,
402 as discussed in clause 11.2.3 of [X.509].
403
404 ( 2.5.4.40 NAME 'crossCertificatePair'
405 DESC 'X.509 cross certificate pair'
406 EQUALITY certificatePairExactMatch
407 SYNTAX 1.3.6.1.4.1.1466.115.121.1.10 )
408
409 As required by this attribute type's syntax, values of this attribute
410 are requested and transferred using the attribute description
411 "crossCertificatePair;binary".
412
4134.4. certificateRevocationList
414
415 The certificateRevocationList attribute holds certificate lists, as
416 discussed in 11.2.4 of [X.509].
417
418 ( 2.5.4.39 NAME 'certificateRevocationList'
419 DESC 'X.509 certificate revocation list'
420 EQUALITY certificateListExactMatch
421 SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )
422
423 As required by this attribute type's syntax, values of this attribute
424 are requested and transferred using the attribute description
425 "certificateRevocationList;binary".
426
4274.5. authorityRevocationList
428
429 The authorityRevocationList attribute holds certificate lists, as
430 discussed in 11.2.5 of [X.509].
431
432 ( 2.5.4.38 NAME 'authorityRevocationList'
433 DESC 'X.509 authority revocation list'
434 EQUALITY certificateListExactMatch
435 SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )
436
437 As required by this attribute type's syntax, values of this attribute
438 are requested and transferred using the attribute description
439 "authorityRevocationList;binary".
440
441
442
443
444
445
446
447
448
449
450Zeilenga Standards Track [Page 8]
451
452RFC 4523 LDAP X.509 Schema June 2006
453
454
4554.6. deltaRevocationList
456
457 The deltaRevocationList attribute holds certificate lists, as
458 discussed in 11.2.6 of [X.509].
459
460 ( 2.5.4.53 NAME 'deltaRevocationList'
461 DESC 'X.509 delta revocation list'
462 EQUALITY certificateListExactMatch
463 SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 )
464
465 As required by this attribute type's syntax, values of this attribute
466 MUST be requested and transferred using the attribute description
467 "deltaRevocationList;binary".
468
4694.7. supportedAlgorithms
470
471 The supportedAlgorithms attribute holds supported algorithms, as
472 discussed in 11.2.7 of [X.509].
473
474 ( 2.5.4.52 NAME 'supportedAlgorithms'
475 DESC 'X.509 supported algorithms'
476 EQUALITY algorithmIdentifierMatch
477 SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 )
478
479 As required by this attribute type's syntax, values of this attribute
480 MUST be requested and transferred using the attribute description
481 "supportedAlgorithms;binary".
482
4835. Object Classes
484
485 This section details a set of certificate-related object classes for
486 use in LDAP.
487
4885.1. pkiUser
489
490 This object class is used in augment entries for objects that may be
491 subject to certificates, as defined in clause 11.1.1 of [X.509].
492
493 ( 2.5.6.21 NAME 'pkiUser'
494 DESC 'X.509 PKI User'
495 SUP top AUXILIARY
496 MAY userCertificate )
497
498
499
500
501
502
503
504
505
506Zeilenga Standards Track [Page 9]
507
508RFC 4523 LDAP X.509 Schema June 2006
509
510
5115.2. pkiCA
512
513 This object class is used to augment entries for objects that act as
514 certificate authorities, as defined in clause 11.1.2 of [X.509]
515
516 ( 2.5.6.22 NAME 'pkiCA'
517 DESC 'X.509 PKI Certificate Authority'
518 SUP top AUXILIARY
519 MAY ( cACertificate $ certificateRevocationList $
520 authorityRevocationList $ crossCertificatePair ) )
521
5225.3. cRLDistributionPoint
523
524 This class is used to represent objects that act as CRL distribution
525 points, as discussed in clause 11.1.3 of [X.509].
526
527 ( 2.5.6.19 NAME 'cRLDistributionPoint'
528 DESC 'X.509 CRL distribution point'
529 SUP top STRUCTURAL
530 MUST cn
531 MAY ( certificateRevocationList $
532 authorityRevocationList $ deltaRevocationList ) )
533
5345.4. deltaCRL
535
536 The deltaCRL object class is used to augment entries to hold delta
537 revocation lists, as discussed in clause 11.1.4 of [X.509].
538
539 ( 2.5.6.23 NAME 'deltaCRL'
540 DESC 'X.509 delta CRL'
541 SUP top AUXILIARY
542 MAY deltaRevocationList )
543
5445.5. strongAuthenticationUser
545
546 This object class is used to augment entries for objects
547 participating in certificate-based authentication, as defined in
548 clause 6.15 of [X.521]. This object class is deprecated in favor of
549 pkiUser.
550
551 ( 2.5.6.15 NAME 'strongAuthenticationUser'
552 DESC 'X.521 strong authentication user'
553 SUP top AUXILIARY
554 MUST userCertificate )
555
556
557
558
559
560
561
562Zeilenga Standards Track [Page 10]
563
564RFC 4523 LDAP X.509 Schema June 2006
565
566
5675.6. userSecurityInformation
568
569 This object class is used to augment entries with needed additional
570 associated security information, as defined in clause 6.16 of
571 [X.521].
572
573 ( 2.5.6.18 NAME 'userSecurityInformation'
574 DESC 'X.521 user security information'
575 SUP top AUXILIARY
576 MAY ( supportedAlgorithms ) )
577
5785.7. certificationAuthority
579
580 This object class is used to augment entries for objects that act as
581 certificate authorities, as defined in clause 6.17 of [X.521]. This
582 object class is deprecated in favor of pkiCA.
583
584 ( 2.5.6.16 NAME 'certificationAuthority'
585 DESC 'X.509 certificate authority'
586 SUP top AUXILIARY
587 MUST ( authorityRevocationList $
588 certificateRevocationList $ cACertificate )
589 MAY crossCertificatePair )
590
5915.8. certificationAuthority-V2
592
593 This object class is used to augment entries for objects that act as
594 certificate authorities, as defined in clause 6.18 of [X.521]. This
595 object class is deprecated in favor of pkiCA.
596
597 ( 2.5.6.16.2 NAME 'certificationAuthority-V2'
598 DESC 'X.509 certificate authority, version 2'
599 SUP certificationAuthority AUXILIARY
600 MAY deltaRevocationList )
601
6026. Security Considerations
603
604 General certificate considerations [RFC3280] apply to LDAP-aware
605 certificate applications. General LDAP security considerations
606 [RFC4510] apply as well.
607
608 While elements of certificate information are commonly signed, these
609 signatures only protect the integrity of the signed information. In
610 the absence of data integrity protections in LDAP (or lower layer,
611 e.g., IPsec), a server is not assured that client certificate request
612 (or other request) was unaltered in transit. Likewise, a client
613 cannot be assured that the results of the query were unaltered in
614
615
616
617
618Zeilenga Standards Track [Page 11]
619
620RFC 4523 LDAP X.509 Schema June 2006
621
622
623 transit. Hence, it is generally recommended that implementations
624 make use of authentication and data integrity services in LDAP
625 [RFC4513][RFC4511].
626
6277. IANA Considerations
628
6297.1. Object Identifier Registration
630
631 The IANA has registered an LDAP Object Identifier [RFC4520] for use
632 in this technical specification.
633
634 Subject: Request for LDAP OID Registration
635 Person & email address to contact for further information:
636 Kurt Zeilenga <kurt@OpenLDAP.org>
637 Specification: RFC 4523
638 Author/Change Controller: IESG
639 Comments:
640 Identifies the LDAP X.509 Certificate schema elements
641 introduced in this document.
642
6437.2. Descriptor Registration
644
645 The IANA has updated the LDAP
646 Descriptor registry [RFC44520] as indicated below.
647
648 Subject: Request for LDAP Descriptor Registration
649 Descriptor (short name): see table
650 Object Identifier: see table
651 Person & email address to contact for further information:
652 Kurt Zeilenga <kurt@OpenLDAP.org>
653 Usage: see table
654 Specification: RFC 4523
655 Author/Change Controller: IESG
656
657 algorithmIdentifierMatch M 2.5.13.40
658 authorityRevocationList A 2.5.4.38 *
659 cACertificate A 2.5.4.37 *
660 cRLDistributionPoint O 2.5.6.19 *
661 certificateExactMatch M 2.5.13.34
662 certificateListExactMatch M 2.5.13.38
663 certificateListMatch M 2.5.13.39
664 certificateMatch M 2.5.13.35
665 certificatePairExactMatch M 2.5.13.36
666 certificatePairMatch M 2.5.13.37
667 certificateRevocationList A 2.5.4.39 *
668 certificationAuthority O 2.5.6.16 *
669 certificationAuthority-V2 O 2.5.6.16.2 *
670 crossCertificatePair A 2.5.4.40 *
671
672
673
674Zeilenga Standards Track [Page 12]
675
676RFC 4523 LDAP X.509 Schema June 2006
677
678
679 deltaCRL O 2.5.6.23 *
680 deltaRevocationList A 2.5.4.53 *
681 pkiCA O 2.5.6.22 *
682 pkiUser O 2.5.6.21 *
683 strongAuthenticationUser O 2.5.6.15 *
684 supportedAlgorithms A 2.5.4.52 *
685 userCertificate A 2.5.4.36 *
686 userSecurityInformation O 2.5.6.18 *
687
688 * Updates previous registration
689
6908. Acknowledgements
691
692 This document is based on X.509, a product of the ITU-T. A number of
693 LDAP schema definitions were based on those found in RFCs 2252 and
694 2256, both products of the IETF ASID WG. The ABNF productions in
695 Appendix A were provided by Steven Legg. Additional material was
696 borrowed from prior works by David Chadwick and Steven Legg to refine
697 the LDAP X.509 schema.
698
6999. References
700
7019.1. Normative References
702
703 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
704 Requirement Levels", BCP 14, RFC 2119, March 1997.
705
706 [RFC3641] Legg, S., "Generic String Encoding Rules (GSER) for ASN.1
707 Types", RFC 3641, October 2003.
708
709 [RFC4510] Zeilenga, K., Ed., "Lightweight Directory Access Protocol
710 (LDAP): Technical Specification Road Map", RFC 4510, June
711 2006.
712
713 [RFC4512] Zeilenga, K., "Lightweight Directory Access Protocol
714 (LDAP): Directory Information Models", RFC 4512, June
715 2006.
716
717 [RFC4522] Legg, S., "Lightweight Directory Access Protocol (LDAP):
718 The Binary Encoding Option", RFC 4522, June 2006.
719
720 [X.509] International Telecommunication Union - Telecommunication
721 Standardization Sector, "The Directory: Authentication
722 Framework", X.509(2000).
723
724
725
726
727
728
729
730Zeilenga Standards Track [Page 13]
731
732RFC 4523 LDAP X.509 Schema June 2006
733
734
735 [X.521] International Telecommunication Union - Telecommunication
736 Standardization Sector, "The Directory: Selected Object
737 Classes", X.521(2000).
738
739 [X.690] International Telecommunication Union - Telecommunication
740 Standardization Sector, "Specification of ASN.1 encoding
741 rules: Basic Encoding Rules (BER), Canonical Encoding
742 Rules (CER), and Distinguished Encoding Rules (DER)",
743 X.690(2002) (also ISO/IEC 8825-1:2002).
744
7459.2. Informative References
746
747 [RFC1777] Yeong, W., Howes, T., and S. Kille, "Lightweight Directory
748 Access Protocol", RFC 1777, March 1995.
749
750 [RFC2156] Kille, S., "MIXER (Mime Internet X.400 Enhanced Relay):
751 Mapping between X.400 and RFC 822/MIME", RFC 2156, January
752 1998.
753
754 [RFC3280] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet
755 X.509 Public Key Infrastructure Certificate and
756 Certificate Revocation List (CRL) Profile", RFC 3280,
757 April 2002.
758
759 [RFC3494] Zeilenga, K., "Lightweight Directory Access Protocol
760 version 2 (LDAPv2) to Historic Status", RFC 3494, March
761 2003.
762
763 [RFC3642] Legg, S., "Common Elements of Generic String Encoding
764 Rules (GSER) Encodings", RFC 3642, October 2003.
765
766 [RFC4234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
767 Specifications: ABNF", RFC 4234, October 2005.
768
769 [RFC4511] Sermersheim, J., Ed., "Lightweight Directory Access
770 Protocol (LDAP): The Protocol", RFC 4511, June 2006.
771
772 [RFC4513] Harrison, R. Ed., "Lightweight Directory Access Protocol
773 (LDAP): Authentication Methods and Security Mechanisms",
774 RFC 4513, June 2006.
775
776 [RFC4520] Zeilenga, K., "Internet Assigned Numbers Authority (IANA)
777 Considerations for the Lightweight Directory Access
778 Protocol (LDAP)", BCP 64, RFC 4520, June 2006.
779
780
781
782
783
784
785
786Zeilenga Standards Track [Page 14]
787
788RFC 4523 LDAP X.509 Schema June 2006
789
790
791Appendix A.
792
793 This appendix is informative.
794
795 This appendix provides ABNF [RFC4234] grammars for GSER-based
796 [RFC3641] LDAP-specific encodings specified in this document. These
797 grammars where produced using, and relying on, Common Elements for
798 GSER Encodings [RFC3642].
799
800A.1. CertificateExactAssertion
801
802 CertificateExactAssertion = "{" sp cea-serialNumber ","
803 sp cea-issuer sp "}"
804
805 cea-serialNumber = id-serialNumber msp CertificateSerialNumber
806 cea-issuer = id-issuer msp Name
807
808 id-serialNumber =
809 %x73.65.72.69.61.6C.4E.75.6D.62.65.72 ; 'serialNumber'
810 id-issuer = %x69.73.73.75.65.72 ; 'issuer'
811
812 Name = id-rdnSequence ":" RDNSequence
813 id-rdnSequence = %x72.64.6E.53.65.71.75.65.6E.63.65 ; 'rdnSequence'
814
815 CertificateSerialNumber = INTEGER
816
817A.2. CertificateAssertion
818
819CertificateAssertion = "{" [ sp ca-serialNumber ]
820 [ sep sp ca-issuer ]
821 [ sep sp ca-subjectKeyIdentifier ]
822 [ sep sp ca-authorityKeyIdentifier ]
823 [ sep sp ca-certificateValid ]
824 [ sep sp ca-privateKeyValid ]
825 [ sep sp ca-subjectPublicKeyAlgID ]
826 [ sep sp ca-keyUsage ]
827 [ sep sp ca-subjectAltName ]
828 [ sep sp ca-policy ]
829 [ sep sp ca-pathToName ]
830 [ sep sp ca-subject ]
831 [ sep sp ca-nameConstraints ] sp "}"
832
833ca-serialNumber = id-serialNumber msp CertificateSerialNumber
834ca-issuer = id-issuer msp Name
835ca-subjectKeyIdentifier = id-subjectKeyIdentifier msp
836 SubjectKeyIdentifier
837ca-authorityKeyIdentifier = id-authorityKeyIdentifier msp
838 AuthorityKeyIdentifier
839
840
841
842Zeilenga Standards Track [Page 15]
843
844RFC 4523 LDAP X.509 Schema June 2006
845
846
847ca-certificateValid = id-certificateValid msp Time
848ca-privateKeyValid = id-privateKeyValid msp GeneralizedTime
849ca-subjectPublicKeyAlgID = id-subjectPublicKeyAlgID msp
850 OBJECT-IDENTIFIER
851ca-keyUsage = id-keyUsage msp KeyUsage
852ca-subjectAltName = id-subjectAltName msp AltNameType
853ca-policy = id-policy msp CertPolicySet
854ca-pathToName = id-pathToName msp Name
855ca-subject = id-subject msp Name
856ca-nameConstraints = id-nameConstraints msp NameConstraintsSyntax
857
858id-subjectKeyIdentifier =
859 %x73.75.62.6A.65.63.74.4B.65.79.49.64.65.6E.74.69.66.69.65.72
860 ; 'subjectKeyIdentifier'
861id-authorityKeyIdentifier =
862 %x61.75.74.68.6F.72.69.74.79.4B.65.79.49.64.65.6E.74.69.66.69.65.72
863 ; 'authorityKeyIdentifier'
864id-certificateValid = %x63.65.72.74.69.66.69.63.61.74.65.56.61.6C.69.64
865 ; 'certificateValid'
866id-privateKeyValid = %x70.72.69.76.61.74.65.4B.65.79.56.61.6C.69.64
867 ; 'privateKeyValid'
868id-subjectPublicKeyAlgID =
869 %x73.75.62.6A.65.63.74.50.75.62.6C.69.63.4B.65.79.41.6C.67.49.44
870 ; 'subjectPublicKeyAlgID'
871id-keyUsage = %x6B.65.79.55.73.61.67.65 ; 'keyUsage'
872id-subjectAltName = %x73.75.62.6A.65.63.74.41.6C.74.4E.61.6D.65
873 ; 'subjectAltName'
874id-policy = %x70.6F.6C.69.63.79 ; 'policy'
875id-pathToName = %x70.61.74.68.54.6F.4E.61.6D.65 ; 'pathToName'
876id-subject = %x73.75.62.6A.65.63.74 ; 'subject'
877id-nameConstraints = %x6E.61.6D.65.43.6F.6E.73.74.72.61.69.6E.74.73
878 ; 'nameConstraints'
879
880SubjectKeyIdentifier = KeyIdentifier
881
882KeyIdentifier = OCTET-STRING
883
884AuthorityKeyIdentifier = "{" [ sp aki-keyIdentifier ]
885 [ sep sp aki-authorityCertIssuer ]
886 [ sep sp aki-authorityCertSerialNumber ] sp "}"
887
888aki-keyIdentifier = id-keyIdentifier msp KeyIdentifier
889aki-authorityCertIssuer = id-authorityCertIssuer msp GeneralNames
890
891GeneralNames = "{" sp GeneralName *( "," sp GeneralName ) sp "}"
892GeneralName = gn-otherName
893 / gn-rfc822Name
894 / gn-dNSName
895
896
897
898Zeilenga Standards Track [Page 16]
899
900RFC 4523 LDAP X.509 Schema June 2006
901
902
903 / gn-x400Address
904 / gn-directoryName
905 / gn-ediPartyName
906 / gn-uniformResourceIdentifier
907 / gn-iPAddress
908 / gn-registeredID
909
910gn-otherName = id-otherName ":" OtherName
911gn-rfc822Name = id-rfc822Name ":" IA5String
912gn-dNSName = id-dNSName ":" IA5String
913gn-x400Address = id-x400Address ":" ORAddress
914gn-directoryName = id-directoryName ":" Name
915gn-ediPartyName = id-ediPartyName ":" EDIPartyName
916gn-iPAddress = id-iPAddress ":" OCTET-STRING
917gn-registeredID = gn-id-registeredID ":" OBJECT-IDENTIFIER
918
919gn-uniformResourceIdentifier = id-uniformResourceIdentifier
920 ":" IA5String
921
922id-otherName = %x6F.74.68.65.72.4E.61.6D.65 ; 'otherName'
923gn-id-registeredID = %x72.65.67.69.73.74.65.72.65.64.49.44
924 ; 'registeredID'
925
926OtherName = "{" sp on-type-id "," sp on-value sp "}"
927on-type-id = id-type-id msp OBJECT-IDENTIFIER
928on-value = id-value msp Value
929 ;; <Value> as defined in Section 3 of [RFC3641]
930
931id-type-id = %x74.79.70.65.2D.69.64 ; 'type-id'
932id-value = %x76.61.6C.75.65 ; 'value'
933
934ORAddress = dquote *SafeIA5Character dquote
935SafeIA5Character = %x01-21 / %x23-7F / ; ASCII minus dquote
936 dquote dquote ; escaped double quote
937dquote = %x22 ; '"' (double quote)
938
939;; Note: The <ORAddress> rule encodes the x400Address component
940;; of a GeneralName as a character string between double quotes.
941;; The character string is first derived according to Section 4.1
942;; of [RFC2156], and then any embedded double quotes are escaped
943;; by being repeated. This resulting string is output between
944;; double quotes.
945
946EDIPartyName = "{" [ sp nameAssigner "," ] sp partyName sp "}"
947nameAssigner = id-nameAssigner msp DirectoryString
948partyName = id-partyName msp DirectoryString
949id-nameAssigner = %x6E.61.6D.65.41.73.73.69.67.6E.65.72
950 ; 'nameAssigner'
951
952
953
954Zeilenga Standards Track [Page 17]
955
956RFC 4523 LDAP X.509 Schema June 2006
957
958
959id-partyName = %x70.61.72.74.79.4E.61.6D.65 ; 'partyName'
960
961aki-authorityCertSerialNumber = id-authorityCertSerialNumber
962 msp CertificateSerialNumber
963
964id-keyIdentifier = %x6B.65.79.49.64.65.6E.74.69.66.69.65.72
965 ; 'keyIdentifier'
966id-authorityCertIssuer =
967 %x61.75.74.68.6F.72.69.74.79.43.65.72.74.49.73.73.75.65.72
968 ; 'authorityCertIssuer'
969
970id-authorityCertSerialNumber = %x61.75.74.68.6F.72.69.74.79.43
971 %x65.72.74.53.65.72.69.61.6C.4E.75.6D.62.65.72
972 ; 'authorityCertSerialNumber'
973
974Time = time-utcTime / time-generalizedTime
975time-utcTime = id-utcTime ":" UTCTime
976time-generalizedTime = id-generalizedTime ":" GeneralizedTime
977id-utcTime = %x75.74.63.54.69.6D.65 ; 'utcTime'
978id-generalizedTime = %x67.65.6E.65.72.61.6C.69.7A.65.64.54.69.6D.65
979 ; 'generalizedTime'
980
981KeyUsage = BIT-STRING / key-usage-bit-list
982key-usage-bit-list = "{" [ sp key-usage *( "," sp key-usage ) ] sp "}"
983
984;; Note: The <key-usage-bit-list> rule encodes the one bits in
985;; a KeyUsage value as a comma separated list of identifiers.
986
987key-usage = id-digitalSignature
988 / id-nonRepudiation
989 / id-keyEncipherment
990 / id-dataEncipherment
991 / id-keyAgreement
992 / id-keyCertSign
993 / id-cRLSign
994 / id-encipherOnly
995 / id-decipherOnly
996
997id-digitalSignature = %x64.69.67.69.74.61.6C.53.69.67.6E.61.74
998 %x75.72.65 ; 'digitalSignature'
999id-nonRepudiation = %x6E.6F.6E.52.65.70.75.64.69.61.74.69.6F.6E
1000 ; 'nonRepudiation'
1001id-keyEncipherment = %x6B.65.79.45.6E.63.69.70.68.65.72.6D.65.6E.74
1002 ; 'keyEncipherment'
1003id-dataEncipherment = %x64.61.74.61.45.6E.63.69.70.68.65.72.6D.65.6E
1004 %x74 ; "dataEncipherment'
1005id-keyAgreement = %x6B.65.79.41.67.72.65.65.6D.65.6E.74
1006 ; 'keyAgreement'
1007
1008
1009
1010Zeilenga Standards Track [Page 18]
1011
1012RFC 4523 LDAP X.509 Schema June 2006
1013
1014
1015id-keyCertSign = %x6B.65.79.43.65.72.74.53.69.67.6E
1016 ; 'keyCertSign'
1017id-cRLSign = %x63.52.4C.53.69.67.6E ; "cRLSign"
1018id-encipherOnly = %x65.6E.63.69.70.68.65.72.4F.6E.6C.79
1019 ; 'encipherOnly'
1020id-decipherOnly = %x64.65.63.69.70.68.65.72.4F.6E.6C.79
1021 ; 'decipherOnly'
1022
1023AltNameType = ant-builtinNameForm / ant-otherNameForm
1024
1025ant-builtinNameForm = id-builtinNameForm ":" BuiltinNameForm
1026ant-otherNameForm = id-otherNameForm ":" OBJECT-IDENTIFIER
1027
1028id-builtinNameForm = %x62.75.69.6C.74.69.6E.4E.61.6D.65.46.6F.72.6D
1029 ; 'builtinNameForm'
1030id-otherNameForm = %x6F.74.68.65.72.4E.61.6D.65.46.6F.72.6D
1031 ; 'otherNameForm'
1032
1033BuiltinNameForm = id-rfc822Name
1034 / id-dNSName
1035 / id-x400Address
1036 / id-directoryName
1037 / id-ediPartyName
1038 / id-uniformResourceIdentifier
1039 / id-iPAddress
1040 / id-registeredId
1041
1042id-rfc822Name = %x72.66.63.38.32.32.4E.61.6D.65 ; 'rfc822Name'
1043id-dNSName = %x64.4E.53.4E.61.6D.65 ; 'dNSName'
1044id-x400Address = %x78.34.30.30.41.64.64.72.65.73.73 ; 'x400Address'
1045id-directoryName = %x64.69.72.65.63.74.6F.72.79.4E.61.6D.65
1046 ; 'directoryName'
1047id-ediPartyName = %x65.64.69.50.61.72.74.79.4E.61.6D.65
1048 ; 'ediPartyName'
1049id-iPAddress = %x69.50.41.64.64.72.65.73.73 ; 'iPAddress'
1050id-registeredId = %x72.65.67.69.73.74.65.72.65.64.49.64
1051 ; 'registeredId'
1052
1053id-uniformResourceIdentifier = %x75.6E.69.66.6F.72.6D.52.65.73.6F.75
1054 %x72.63.65.49.64.65.6E.74.69.66.69.65.72
1055 ; 'uniformResourceIdentifier'
1056
1057CertPolicySet = "{" sp CertPolicyId *( "," sp CertPolicyId ) sp "}"
1058CertPolicyId = OBJECT-IDENTIFIER
1059
1060NameConstraintsSyntax = "{" [ sp ncs-permittedSubtrees ]
1061 [ sep sp ncs-excludedSubtrees ] sp "}"
1062
1063
1064
1065
1066Zeilenga Standards Track [Page 19]
1067
1068RFC 4523 LDAP X.509 Schema June 2006
1069
1070
1071ncs-permittedSubtrees = id-permittedSubtrees msp GeneralSubtrees
1072ncs-excludedSubtrees = id-excludedSubtrees msp GeneralSubtrees
1073
1074id-permittedSubtrees =
1075 %x70.65.72.6D.69.74.74.65.64.53.75.62.74.72.65.65.73
1076 ; 'permittedSubtrees'
1077id-excludedSubtrees =
1078 %x65.78.63.6C.75.64.65.64.53.75.62.74.72.65.65.73
1079 ; 'excludedSubtrees'
1080
1081GeneralSubtrees = "{" sp GeneralSubtree
1082 *( "," sp GeneralSubtree ) sp "}"
1083GeneralSubtree = "{" sp gs-base
1084 [ "," sp gs-minimum ]
1085 [ "," sp gs-maximum ] sp "}"
1086
1087gs-base = id-base msp GeneralName
1088gs-minimum = id-minimum msp BaseDistance
1089gs-maximum = id-maximum msp BaseDistance
1090
1091id-base = %x62.61.73.65 ; 'base'
1092id-minimum = %x6D.69.6E.69.6D.75.6D ; 'minimum'
1093id-maximum = %x6D.61.78.69.6D.75.6D ; 'maximum'
1094
1095BaseDistance = INTEGER-0-MAX
1096
1097A.3. CertificatePairExactAssertion
1098
1099 CertificatePairExactAssertion = "{" [ sp cpea-issuedTo ]
1100 [sep sp cpea-issuedBy ] sp "}"
1101 ;; At least one of <cpea-issuedTo> or <cpea-issuedBy> MUST be present.
1102
1103 cpea-issuedTo = id-issuedToThisCAAssertion msp
1104 CertificateExactAssertion
1105 cpea-issuedBy = id-issuedByThisCAAssertion msp
1106 CertificateExactAssertion
1107
1108 id-issuedToThisCAAssertion = %x69.73.73.75.65.64.54.6F.54.68.69.73
1109 %x43.41.41.73.73.65.72.74.69.6F.6E ; 'issuedToThisCAAssertion'
1110 id-issuedByThisCAAssertion = %x69.73.73.75.65.64.42.79.54.68.69.73
1111 %x43.41.41.73.73.65.72.74.69.6F.6E ; 'issuedByThisCAAssertion'
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122Zeilenga Standards Track [Page 20]
1123
1124RFC 4523 LDAP X.509 Schema June 2006
1125
1126
1127A.4. CertificatePairAssertion
1128
1129 CertificatePairAssertion = "{" [ sp cpa-issuedTo ]
1130 [sep sp cpa-issuedBy ] sp "}"
1131 ;; At least one of <cpa-issuedTo> and <cpa-issuedBy> MUST be present.
1132
1133 cpa-issuedTo = id-issuedToThisCAAssertion msp CertificateAssertion
1134 cpa-issuedBy = id-issuedByThisCAAssertion msp CertificateAssertion
1135
1136A.5. CertificateListExactAssertion
1137
1138 CertificateListExactAssertion = "{" sp clea-issuer ","
1139 sp clea-thisUpdate
1140 [ "," sp clea-distributionPoint ] sp "}"
1141
1142 clea-issuer = id-issuer msp Name
1143 clea-thisUpdate = id-thisUpdate msp Time
1144 clea-distributionPoint = id-distributionPoint msp
1145 DistributionPointName
1146
1147 id-thisUpdate = %x74.68.69.73.55.70.64.61.74.65 ; 'thisUpdate'
1148 id-distributionPoint =
1149 %x64.69.73.74.72.69.62.75.74.69.6F.6E.50.6F.69.6E.74
1150 ; 'distributionPoint'
1151
1152 DistributionPointName = dpn-fullName / dpn-nameRelativeToCRLIssuer
1153
1154 dpn-fullName = id-fullName ":" GeneralNames
1155 dpn-nameRelativeToCRLIssuer = id-nameRelativeToCRLIssuer ":"
1156 RelativeDistinguishedName
1157
1158 id-fullName = %x66.75.6C.6C.4E.61.6D.65 ; 'fullName'
1159 id-nameRelativeToCRLIssuer = %x6E.61.6D.65.52.65.6C.61.74.69.76.65
1160 %x54.6F.43.52.4C.49.73.73.75.65.72 ; 'nameRelativeToCRLIssuer'
1161
1162A.6. CertificateListAssertion
1163
1164 CertificateListAssertion = "{" [ sp cla-issuer ]
1165 [ sep sp cla-minCRLNumber ]
1166 [ sep sp cla-maxCRLNumber ]
1167 [ sep sp cla-reasonFlags ]
1168 [ sep sp cla-dateAndTime ]
1169 [ sep sp cla-distributionPoint ]
1170 [ sep sp cla-authorityKeyIdentifier ] sp "}"
1171
1172 cla-issuer = id-issuer msp Name
1173 cla-minCRLNumber = id-minCRLNumber msp CRLNumber
1174 cla-maxCRLNumber = id-maxCRLNumber msp CRLNumber
1175
1176
1177
1178Zeilenga Standards Track [Page 21]
1179
1180RFC 4523 LDAP X.509 Schema June 2006
1181
1182
1183 cla-reasonFlags = id-reasonFlags msp ReasonFlags
1184 cla-dateAndTime = id-dateAndTime msp Time
1185
1186 cla-distributionPoint = id-distributionPoint msp
1187 DistributionPointName
1188
1189 cla-authorityKeyIdentifier = id-authorityKeyIdentifier msp
1190 AuthorityKeyIdentifier
1191
1192 id-minCRLNumber = %x6D.69.6E.43.52.4C.4E.75.6D.62.65.72
1193 ; 'minCRLNumber'
1194 id-maxCRLNumber = %x6D.61.78.43.52.4C.4E.75.6D.62.65.72
1195 ; 'maxCRLNumber'
1196 id-reasonFlags = %x72.65.61.73.6F.6E.46.6C.61.67.73 ; 'reasonFlags'
1197 id-dateAndTime = %x64.61.74.65.41.6E.64.54.69.6D.65 ; 'dateAndTime'
1198
1199 CRLNumber = INTEGER-0-MAX
1200
1201 ReasonFlags = BIT-STRING
1202 / "{" [ sp reason-flag *( "," sp reason-flag ) ] sp "}"
1203
1204 reason-flag = id-unused
1205 / id-keyCompromise
1206 / id-cACompromise
1207 / id-affiliationChanged
1208 / id-superseded
1209 / id-cessationOfOperation
1210 / id-certificateHold
1211 / id-privilegeWithdrawn
1212 / id-aACompromise
1213
1214 id-unused = %x75.6E.75.73.65.64 ; 'unused'
1215 id-keyCompromise = %x6B.65.79.43.6F.6D.70.72.6F.6D.69.73.65
1216 ; 'keyCompromise'
1217 id-cACompromise = %x63.41.43.6F.6D.70.72.6F.6D.69.73.65
1218 ; 'cACompromise'
1219 id-affiliationChanged =
1220 %x61.66.66.69.6C.69.61.74.69.6F.6E.43.68.61.6E.67.65.64
1221 ; 'affiliationChanged'
1222 id-superseded = %x73.75.70.65.72.73.65.64.65.64 ; 'superseded'
1223 id-cessationOfOperation =
1224 %x63.65.73.73.61.74.69.6F.6E.4F.66.4F.70.65.72.61.74.69.6F.6E
1225 ; 'cessationOfOperation'
1226 id-certificateHold = %x63.65.72.74.69.66.69.63.61.74.65.48.6F.6C.64
1227 ; 'certificateHold'
1228 id-privilegeWithdrawn =
1229 %x70.72.69.76.69.6C.65.67.65.57.69.74.68.64.72.61.77.6E
1230 ; 'privilegeWithdrawn'
1231
1232
1233
1234Zeilenga Standards Track [Page 22]
1235
1236RFC 4523 LDAP X.509 Schema June 2006
1237
1238
1239 id-aACompromise = %x61.41.43.6F.6D.70.72.6F.6D.69.73.65
1240 ; 'aACompromise'
1241
1242A.7. AlgorithmIdentifier
1243
1244 AlgorithmIdentifier = "{" sp ai-algorithm
1245 [ "," sp ai-parameters ] sp "}"
1246
1247 ai-algorithm = id-algorithm msp OBJECT-IDENTIFIER
1248 ai-parameters = id-parameters msp Value
1249 id-algorithm = %x61.6C.67.6F.72.69.74.68.6D ; 'algorithm'
1250 id-parameters = %x70.61.72.61.6D.65.74.65.72.73 ; 'parameters'
1251
1252Author's Address
1253
1254 Kurt D. Zeilenga
1255 OpenLDAP Foundation
1256
1257 EMail: Kurt@OpenLDAP.org
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290Zeilenga Standards Track [Page 23]
1291
1292RFC 4523 LDAP X.509 Schema June 2006
1293
1294
1295Full Copyright Statement
1296
1297 Copyright (C) The Internet Society (2006).
1298
1299 This document is subject to the rights, licenses and restrictions
1300 contained in BCP 78, and except as set forth therein, the authors
1301 retain all their rights.
1302
1303 This document and the information contained herein are provided on an
1304 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
1305 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
1306 ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
1307 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
1308 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
1309 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
1310
1311Intellectual Property
1312
1313 The IETF takes no position regarding the validity or scope of any
1314 Intellectual Property Rights or other rights that might be claimed to
1315 pertain to the implementation or use of the technology described in
1316 this document or the extent to which any license under such rights
1317 might or might not be available; nor does it represent that it has
1318 made any independent effort to identify any such rights. Information
1319 on the procedures with respect to rights in RFC documents can be
1320 found in BCP 78 and BCP 79.
1321
1322 Copies of IPR disclosures made to the IETF Secretariat and any
1323 assurances of licenses to be made available, or the result of an
1324 attempt made to obtain a general license or permission for the use of
1325 such proprietary rights by implementers or users of this
1326 specification can be obtained from the IETF on-line IPR repository at
1327 http://www.ietf.org/ipr.
1328
1329 The IETF invites any interested party to bring to its attention any
1330 copyrights, patents or patent applications, or other proprietary
1331 rights that may cover technology that may be required to implement
1332 this standard. Please address the information to the IETF at
1333 ietf-ipr@ietf.org.
1334
1335Acknowledgement
1336
1337 Funding for the RFC Editor function is provided by the IETF
1338 Administrative Support Activity (IASA).
1339
1340
1341
1342
1343
1344
1345
1346Zeilenga Standards Track [Page 24]
1347