ISO/IEC 9594-2:2014
(Main)Information technology — Open Systems Interconnection — The Directory — Part 2: Models
Information technology — Open Systems Interconnection — The Directory — Part 2: Models
ISO/IEC 9594 has been produced to facilitate the interconnection of information processing systems to provide directory services. A set of such systems, together with the directory information that they hold, can be viewed as an integrated whole, called the Directory. The information held by the Directory, collectively known as the Directory Information Base (DIB), is typically used to facilitate communication between, with or about objects such as application entities, people, terminals and distribution lists. ISO/IEC 9594-2:2014 provides a number of different models for the Directory as a framework for the other parts of ISO/IEC 9594. The models are the overall (functional) model; the administrative authority model, generic Directory Information Models providing Directory User and Administrative User views on Directory information, generic DSA (Directory System Agent) and DSA information models, an Operational Framework and a security model.
Technologies de l'information — Interconnexion de systèmes ouverts (OSI) — L'annuaire — Partie 2: Les modèles
General Information
Relations
Standards Content (Sample)
INTERNATIONAL ISO/IEC
STANDARD 9594-2
Seventh edition
2014-03-01
Information technology — Open Systems
Interconnection — The Directory —
Part 2:
Models
Technologies de l'information — Interconnexion de systèmes ouverts
(OSI) — L'annuaire
Partie 2: Les modèles
Reference number
ISO/IEC 9594-2:2014(E)
©
ISO/IEC 2014
---------------------- Page: 1 ----------------------
ISO/IEC 9594-2:2014(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2014
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any
means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission.
Permission can be requested from either ISO at the address below or ISO’s member body in the country of the requester.
ISO copyright office
Case postale 56 CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2014 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 9594-2:2014(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members of
ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information
technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as
an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 9594-2 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 6, Telecommunications and information exchange between systems, in collaboration with
ITU-T. The identical text is published as Rec. ITU-T X.501 (10/2012).
This seventh edition cancels and replaces the sixth edition (ISO/IEC 9594-2:2008), which has been
technically revised. It also incorporates the Technical Corrigenda ISO/IEC 9594-2:2008/Cor.1:2011 and
ISO/IEC 9594-2:2008/Cor.2:2012.
ISO/IEC 9594 consists of the following parts, under the general title Information technology — Open Systems
Interconnection — The Directory:
— Part 1: Overview of concepts, models and services
— Part 2: Models
— Part 3: Abstract service definition
— Part 4: Procedures for distributed operation
— Part 5: Protocol specifications
— Part 6: Selected attribute types
— Part 7: Selected object classes
— Part 8: Public-key and attribute certificate frameworks
— Part 9: Replication
© ISO/IEC 2014 – All rights reserved
---------------------- Page: 3 ----------------------
CONTENTS
Page
1 Scope . 1
2 Normative references . 2
2.1 Identical Recommendations | International Standards . 2
2.2 Paired Recommendations | International Standards equivalent in technical content . 2
2.3 Other references . 3
3 Definitions . 3
3.1 Communication definitions . 3
3.2 Basic Directory definitions . 3
3.3 Distributed operation definitions . 3
3.4 Replication definitions . 3
4 Abbreviations . 4
5 Conventions . 5
6 Directory Models . 6
6.1 Definitions . 6
6.2 The Directory and its users . 6
6.3 Directory and DSA Information Models . 7
6.4 Directory Administrative Authority Model . 7
7 Directory Information Base . 9
7.1 Definitions . 9
7.2 Objects . 10
7.3 Directory entries . 10
7.4 Directory Information Tree (DIT) . 10
8 Directory entries . 11
8.1 Definitions . 11
8.2 Overall structure . 13
8.3 Object classes . 14
8.4 Attribute types . 16
8.5 Attribute values . 16
8.6 Attribute type hierarchies . 16
8.7 Friend attributes . 17
8.8 Contexts . 17
8.9 Matching rules . 18
8.10 Entry collections. 21
8.11 Compound entries and families of entries . 22
9 Names . 23
9.1 Definitions . 23
9.2 Names in general . 23
9.3 Relative distinguished name . 23
9.4 Name matching . 24
9.5 Distinguished names . 24
9.6 Alias names . 25
10 Hierarchical groups . 25
10.1 Definitions . 25
10.2 Hierarchical relationship . 26
10.3 Sequential ordering of a hierarchical group . 27
11 Directory Administrative Authority model . 28
11.1 Definitions . 28
11.2 Overview . 28
11.3 Policy . 29
11.4 Specific administrative authorities . 29
11.5 Administrative areas and administrative points . 30
Rec. ITU-T X.501 (10/2012) iii
---------------------- Page: 4 ----------------------
Page
11.6 DIT Domain policies . 32
11.7 DMD policies . 32
12 Model of Directory Administrative and Operational Information . 34
12.1 Definitions . 34
12.2 Overview . 34
12.3 Subtrees . 35
12.4 Operational attributes . 37
12.5 Entries . 38
12.6 Subentries . 38
12.7 Information model for collective attributes . 39
12.8 Information model for context defaults . 40
13 Directory Schema . 41
13.1 Definitions . 41
13.2 Overview . 41
13.3 Object class definition . 43
13.4 Attribute type definition . 45
13.5 Matching rule definition . 48
13.6 Relaxation and tightening. 50
13.7 DIT structure definition . 56
13.8 DIT content rule definition . 59
13.9 Context type definition . 60
13.10 DIT Context Use definition . 62
13.11 Friends definition . 62
13.12 Syntax definitions. 63
14 Directory System Schema . 63
14.1 Overview . 63
14.2 System schema supporting the administrative and operational information model . 64
14.3 System schema supporting the administrative model . 64
14.4 System schema supporting general administrative and operational requirements . 65
14.5 System schema supporting access control . 67
14.6 System schema supporting the collective attribute model . 67
14.7 System schema supporting context assertion defaults . 68
14.8 System schema supporting the service administration model . 68
14.9 System schema supporting password administration . 69
14.10 System schema supporting hierarchical groups . 70
14.11 Maintenance of system schema . 70
14.12 System schema for first-level subordinates . 71
15 Directory schema administration . 71
15.1 Overview . 71
15.2 Policy objects . 71
15.3 Policy parameters . 72
15.4 Policy procedures . 72
15.5 Subschema modification procedures . 72
15.6 Entry addition and modification procedures . 73
15.7 Subschema policy attributes . 73
16 Service Administration Model . 80
16.1 Definitions . 80
16.2 Service-type/user-class model . 80
16.3 Service-specific administrative areas . 81
16.4 Introduction to search-rules . 82
16.5 Subfilters . 82
16.6 Filter requirements . 83
16.7 Attribute information selection based on search-rules . 83
16.8 Access control aspects of search-rules . 84
iv Rec. ITU-T X.501 (10/2012)
---------------------- Page: 5 ----------------------
Page
16.9 Contexts aspects of search-rules . 84
16.10 Search-rule specification . 84
16.11 Matching restriction definition . 92
16.12 Search-validation function . 92
17 Security model . 94
17.1 Definitions . 94
17.2 Security policies . 94
17.3 Protection of Directory operations . 95
18 Basic Access Control . 96
18.1 Scope and application . 96
18.2 Basic Access Control model . 96
18.3 Access control administrative areas . 98
18.4 Representation of Access Control Information . 101
18.5 ACI operational attributes . 106
18.6 Protecting the ACI . 107
18.7 Access control and Directory operations . 107
18.8 Access Control Decision Function . 107
18.9 Simplified Access Control . 109
19 Rule-based Access Contro l . 109
19.1 Scope and application . 109
19.2 Rule-based Access Control model . 110
19.3 Access control administrative areas . 110
19.4 Security Label . 110
19.5 Clearance . 112
19.6 Access Control and Directory operations . 112
19.7 Access Control Decision Function . 113
19.8 Use of Rule-based and Basic Access Control . 113
20 Data Integrity in Storage . 113
20.1 Introduction . 113
20.2 Protection of an Entry or Selected Attribute Types . 113
20.3 Context for Protection of a Single Attribute Value . 115
21 DSA Models . 116
21.1 Definitions . 116
21.2 Directory Functional Model . 116
21.3 Directory Distribution Model . 117
22 Knowledge . 119
22.1 Definitions . 119
22.2 Introduction . 119
22.3 Knowledge References . 120
22.4 Minimum Knowledge . 122
22.5 First Level DSAs . 122
22.6 Knowledge references to LDAP servers . 123
23 Basic Elements of the DSA Information Model . 123
23.1 Definitions . 123
23.2 Introduction . 123
23.3 DSA Specific Entries and their Names . 124
23.4 Basic Elements . 125
24 Representation of DSA Information . 127
24.1 Representation of Directory User and Operational Information . 127
24.2 Representation of Knowledge References. 127
24.3 Representation of Names and Naming Contexts . 134
25 Overview . 136
25.1 Definitions . 136
Rec. ITU-T X.501 (10/2012) v
---------------------- Page: 6 ----------------------
Page
25.2 Introduction . 136
26 Operational bindings . 136
26.1 General . 136
26.2 Application of the operational framework . 137
26.3 States of cooperation . 138
27 Operational binding specification and management . 139
27.1 Operational binding type specification . 139
27.2 Operational binding management . 140
27.3 Operational binding specification templates . 140
28 Operations for operational binding management . 142
28.1 Application-context definition . 142
28.2 Establish Operational Binding operation . 143
28.3 Modify Operational Binding operation .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.