Information technology — Open systems interconnection — Part 2: The Directory: Models

This document provides a conceptual and terminological framework for the other ITU-T X.500-series Recommendations | parts of ISO/IEC 9594 which define various aspects of the Directory. The functional and administrative authority models define ways in which the Directory can be distributed, both functionally and administratively. Generic Directory System Agent (DSA) and DSA information models and an Operational Framework are also provided to support Directory distribution. The generic Directory Information Models describe the logical structure of the Directory Information Base (DIB) from the perspective of Directory and Administrative Users. In these models, the fact that the Directory is distributed, rather than centralized, is not visible. This Recommendation | International Standard provides a specialization of the generic Directory Information Models to support Directory Schema administration. The other ITU-T Recommendations in the X.500 series | parts of ISO/IEC 9594 make use of the concepts defined in this Recommendation | International Standard to define specializations of the generic information and DSA models to provide specific information, DSA and operational models supporting particular directory capabilities (e.g., Replication): a) the service provided by the Directory is described (in Rec. ITU-T X.511 | ISO/IEC 9594-3) in terms of the concepts of the information framework: this allows the service provided to be somewhat independent of the physical distribution of the DIB; b) the distributed operation of the Directory is specified (in Rec. ITU-T X.518 | ISO/IEC 9594-4) so as to provide that service, and therefore maintain that logical information structure, given that the DIB is in fact highly distributed; c) replication capabilities offered by the component parts of the Directory to improve overall Directory performance are specified (in Rec. ITU-T X.525 | ISO/IEC 9594-9). The security model establishes a framework for the specification of access control mechanisms. It provides a mechanism for identifying the access control scheme in effect in a particular portion of the Directory Information Tree (DIT), and it defines three flexible, specific access control schemes which are suitable for a wide variety of applications and styles of use. The security model also provides a framework for protecting the confidentiality and integrity of directory operations using mechanisms such as encryption and digital signatures. This makes use of the framework for authentication defined in Rec. ITU-T X.509 | ISO/IEC 9594-8 as well as generic upper layers security tools defined in Rec. ITU-T X.830 | ISO/IEC 11586-1. DSA models establish a framework for the specification of the operation of the components of the Directory. Specifically: a) the Directory functional model describes how the Directory is manifested as a set of one or more components, each being a DSA; b) the Directory distribution model describes the principals according to which the DIB entries and entry‑copies may be distributed among DSAs; c) the DSA information model describes the structure of the Directory user and operational information held in a DSA; d) the DSA operational framework describes the means by which the definition of specific forms of cooperation between DSAs to achieve particular objectives (e.g., shadowing) is structured.

Technologies de l'information — Interconnexion de systèmes ouverts (OSI) — Partie 2: Titre manque

General Information

Status
Published
Publication Date
29-Nov-2020
Current Stage
6060 - International Standard published
Start Date
09-Nov-2020
Completion Date
30-Nov-2020
Ref Project

RELATIONS

Buy Standard

Standard
ISO/IEC 9594-2:Version 24-okt-2020 - Information technology -- Open systems interconnection
English language
238 pages
sale 15% off
Preview
sale 15% off
Preview
Standard
ISO/IEC 9594-2:2020 - Information technology -- Open systems interconnection
English language
238 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (sample)

INTERNATIONAL ISO/IEC
STANDARD 9594-2
Ninth edition
Information technology — Open
systems interconnection —
Part 2:
The Directory: Models
PROOF/ÉPREUVE
Reference number
ISO/IEC 9594-2:2020(E)
© ISO/IEC 2020
---------------------- Page: 1 ----------------------
ISO/IEC 9594-2:2020(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2020

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii PROOF/ÉPREUVE © ISO/IEC 2020 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 9594-2:2020(E)
Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide standardization. National bodies that are

members of ISO or IEC participate in the development of International Standards through technical

committees established by the respective organization to deal with particular fields of technical activity.

ISO and IEC technical committees collaborate in fields of mutual interest. Other international

organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the

work.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of document should be noted (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details

of any patent rights identified during the development of the document will be in the Introduction and/or

on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC list of patent

declarations received (see http://patents.iec.ch).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see

www.iso.org/iso/foreword.html.

This document was prepared by ITU-T as ITU-T X.501 (10/2019) and drafted in accordance with

its editorial rules. It was adopted by Joint Technical Committee ISO/IEC JTC 1, Information

technology, Subcommittee SC 6, Telecommunications and information exchange between systems.

A list of all parts in the ISO/IEC 9594 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body. A

complete listing of these bodies can be found at www.iso.org/members.html.
© ISO/IEC 2020 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 9594-2:2020 (E)
CONTENTS
Page

SECTION 1 – GENERAL ......................................................................................................................................... 1

1 Scope .............................................................................................................................................................. 1

2 References ...................................................................................................................................................... 2

2.1 Normative references .......................................................................................................................... 2

2.2 Non-normative references ................................................................................................................... 3

3 Definitions ...................................................................................................................................................... 3

3.1 Communication definitions ................................................................................................................. 3

3.2 Basic Directory definitions .................................................................................................................. 3

3.3 Distributed operation definitions ......................................................................................................... 3

3.4 Replication definitions ........................................................................................................................ 3

4 Abbreviations ................................................................................................................................................. 4

5 Conventions .................................................................................................................................................... 5

SECTION 2 – OVERVIEW OF THE DIRECTORY MODELS .............................................................................. 6

6 Directory Models ............................................................................................................................................ 6

6.1 Definitions ........................................................................................................................................... 6

6.2 The Directory and its users .................................................................................................................. 6

6.3 Directory and DSA Information Models ............................................................................................. 7

6.4 Directory Administrative Authority Model ......................................................................................... 7

SECTION 3 – MODEL OF DIRECTORY USER INFORMATION ........................................................................ 9

7 Directory Information Base ............................................................................................................................ 9

7.1 Definitions ........................................................................................................................................... 9

7.2 Objects ................................................................................................................................................ 10

7.3 Directory entries .................................................................................................................................. 10

7.4 Directory Information Tree (DIT) ....................................................................................................... 10

8 Directory entries ............................................................................................................................................. 11

8.1 Definitions ........................................................................................................................................... 11

8.2 Overall structure .................................................................................................................................. 13

8.3 Object classes ...................................................................................................................................... 14

8.4 Attribute types ..................................................................................................................................... 16

8.5 Attribute values ................................................................................................................................... 16

8.6 Attribute type hierarchies .................................................................................................................... 16

8.7 Friend attributes .................................................................................................................................. 17

8.8 Contexts .............................................................................................................................................. 17

8.9 Matching rules ..................................................................................................................................... 18

8.10 Entry collections .................................................................................................................................. 21

8.11 Compound entries and families of entries ........................................................................................... 22

9 Names ............................................................................................................................................................. 23

9.1 Definitions ........................................................................................................................................... 23

9.2 Names in general ................................................................................................................................. 23

9.3 Relative distinguished name ................................................................................................................ 23

9.4 Name matching ................................................................................................................................... 24

9.5 Distinguished names ........................................................................................................................... 24

9.6 Alias names ......................................................................................................................................... 25

10 Hierarchical groups ........................................................................................................................................ 25

10.1 Definitions ........................................................................................................................................... 25

10.2 Hierarchical relationship ..................................................................................................................... 26

10.3 Sequential ordering of a hierarchical group ........................................................................................ 26

SECTION 4 – DIRECTORY ADMINISTRATIVE MODEL ................................................................................... 28

11 Directory Administrative Authority model .................................................................................................... 28

11.1 Definitions ........................................................................................................................................... 28

© ISO/IEC 2020 – All rights reserved
Rec. ITU-T X.501 (10/2019) v
---------------------- Page: 4 ----------------------
ISO/IEC 9594-2:2020 (E)
Page

11.2 Overview ............................................................................................................................................. 28

11.3 Policy .................................................................................................................................................. 29

11.4 Specific administrative authorities ...................................................................................................... 29

11.5 Administrative areas and administrative points .................................................................................. 30

11.6 DIT Domain policies ........................................................................................................................... 32

11.7 DMD policies ...................................................................................................................................... 32

SECTION 5 – MODEL OF DIRECTORY ADMINISTRATIVE AND OPERATIONAL INFORMATION ......... 34

12 Model of Directory Administrative and Operational Information .................................................................. 34

12.1 Definitions ........................................................................................................................................... 34

12.2 Overview ............................................................................................................................................. 34

12.3 Subtrees ............................................................................................................................................... 35

12.4 Operational attributes .......................................................................................................................... 37

12.5 Entries ................................................................................................................................................. 37

12.6 Subentries ............................................................................................................................................ 38

12.7 Information model for collective attributes ......................................................................................... 39

12.8 Information model for context defaults ............................................................................................... 40

SECTION 6 – THE DIRECTORY SCHEMA .......................................................................................................... 41

13 Directory Schema ........................................................................................................................................... 41

13.1 Definitions ........................................................................................................................................... 41

13.2 Overview ............................................................................................................................................. 41

13.3 Object class definition ......................................................................................................................... 43

13.4 Attribute type definition ...................................................................................................................... 45

13.5 Matching rule definition ...................................................................................................................... 48

13.6 Relaxation and tightening .................................................................................................................... 50

13.7 DIT structure definition ....................................................................................................................... 56

13.8 DIT content rule definition .................................................................................................................. 59

13.9 Context type definition ........................................................................................................................ 60

13.10 DIT Context Use definition ................................................................................................................. 61

13.11 Friends definition ................................................................................................................................ 62

13.12 Syntax definitions ................................................................................................................................ 63

14 Directory System Schema .............................................................................................................................. 63

14.1 Overview ............................................................................................................................................. 63

14.2 System schema supporting the administrative and operational information model ............................ 63

14.3 System schema supporting the administrative model .......................................................................... 64

14.4 System schema supporting general administrative and operational requirements .............................. 65

14.5 System schema supporting access control ........................................................................................... 67

14.6 System schema supporting the collective attribute model ................................................................... 67

14.7 System schema supporting context assertion defaults ......................................................................... 67

14.8 System schema supporting the service administration model ............................................................. 68

14.9 System schema supporting password administration .......................................................................... 68

14.10 System schema supporting hierarchical groups................................................................................... 69

14.11 Maintenance of system schema ........................................................................................................... 70

14.12 System schema for first-level subordinates ......................................................................................... 71

15 Directory schema administration .................................................................................................................... 71

15.1 Overview ............................................................................................................................................. 71

15.2 Policy objects ...................................................................................................................................... 71

15.3 Policy parameters ................................................................................................................................ 71

15.4 Policy procedures ................................................................................................................................ 72

15.5 Subschema modification procedures ................................................................................................... 72

15.6 Entry addition and modification procedures ....................................................................................... 73

15.7 Subschema policy attributes ................................................................................................................ 73

SECTION 7 – DIRECTORY SERVICE ADMINISTRATION ................................................................................ 79

16 Service Administration Model........................................................................................................................ 79

© ISO/IEC 2020 – All rights reserved
vi Rec. ITU-T X.501 (10/2019)
---------------------- Page: 5 ----------------------
ISO/IEC 9594-2:2020 (E)
Page

16.1 Definitions ........................................................................................................................................... 79

16.2 Service-type/user-class model ............................................................................................................. 79

16.3 Service-specific administrative areas .................................................................................................. 80

16.4 Introduction to search-rules ................................................................................................................. 81

16.5 Subfilters ............................................................................................................................................. 81

16.6 Filter requirements .............................................................................................................................. 82

16.7 Attribute information selection based on search-rules ........................................................................ 82

16.8 Access control aspects of search-rules ................................................................................................ 83

16.9 Contexts aspects of search-rules .......................................................................................................... 83

16.10 Search-rule specification ..................................................................................................................... 83

16.11 Matching restriction definition ............................................................................................................ 91

16.12 Search-validation function .................................................................................................................. 91

SECTION 8 – SECURITY ........................................................................................................................................ 93

17 Security model ................................................................................................................................................ 93

17.1 Definitions ........................................................................................................................................... 93

17.2 Security policies .................................................................................................................................. 93

17.3 Protection of Directory operations ...................................................................................................... 94

18 Basic Access Control ...................................................................................................................................... 95

18.1 Scope and application.......................................................................................................................... 95

18.2 Basic Access Control model ............................................................................................................... 95

18.3 Access control administrative areas .................................................................................................... 98

18.4 Representation of Access Control Information ................................................................................... 100

18.5 ACI operational attributes ................................................................................................................... 105

18.6 Protecting the ACI ............................................................................................................................... 106

18.7 Access control and Directory operations ............................................................................................. 106

18.8 Access Control Decision Function ...................................................................................................... 106

18.9 Simplified Access Control .................................................................................................................. 108

19 Rule-based Access Control ............................................................................................................................. 108

19.1 Scope and application.......................................................................................................................... 108

19.2 Rule-based Access Control model ...................................................................................................... 108

19.3 Access control administrative areas .................................................................................................... 109

19.4 Security Label ..................................................................................................................................... 109

19.5 Clearance ............................................................................................................................................. 110

19.6 Access Control and Directory operations ............................................................................................ 111

19.7 Access Control Decision Function ...................................................................................................... 111

19.8 Use of Rule-based and Basic Access Control ..................................................................................... 112

20 Data Integrity in Storage ................................................................................................................................ 112

20.1 Introduction ......................................................................................................................................... 112

20.2 Protection of an Entry or Selected Attribute Types ............................................................................. 112

20.3 Context for Protection of a Single Attribute Value ............................................................................. 114

SECTION 9 – DSA MODELS .................................................................................................................................. 115

21 DSA Models ................................................................................................................................................... 115

21.1 Definitions ........................................................................................................................................... 115

21.2 Directory Functional Model ................................................................................................................ 115

21.3 Directory Distribution Model .............................................................................................................. 116

SECTION 10 – DSA INFORMATION MODEL ...................................................................................................... 118

22 Knowledge...................................................................................................................................................... 118

22.1 Definitions ........................................................................................................................................... 118

22.2 Introduction ......................................................................................................................................... 118

22.3 Knowledge References ........................................................................................................................ 119

22.4 Minimum Knowledge ......................................................................................................................... 121

22.5 First Level DSAs ................................................................................................................................. 121

22.6 Knowledge references to LDAP servers ............................................................................................. 122

© ISO/IEC 2020 – All rights reserved
Rec. ITU-T X.501 (10/2019) vii
---------------------- Page: 6 ----------------------
ISO/IEC 9594-2:2020 (E)
Page

23 Basic Elements of the DSA Information Model ............................................................................................. 122

23.1 Definitions ........................................................................................................................................... 122

23.2 Introduction ......................................................................................................................................... 122

23.3 DSA Specific Entries and their Names ............................................................................................... 123

23.4 Basic Elements .................................................................................................................................... 124

24 Representation of DSA Information ............................................................................................................... 125

24.1 Representation of Directory User and Operational Information ......................................................... 126

24.2 Representation of Knowledge References ........................................................................................... 126

24.3 Representation of Names and Naming Contexts ................................................................................. 133

SECTION 11 – DSA OPERATIONAL FRAMEWORK .......................................................................................... 135

25 Overview ........................................................................................................................................................ 135

25.1 Definitions ........................................................................................................................................... 135

25.2 Introduction ......................................................................................................................................... 135

26 Operational bindings ...................................................................................................................................... 1

...

INTERNATIONAL ISO/IEC
STANDARD 9594-2
Ninth edition
2020-11
Information technology — Open
systems interconnection —
Part 2:
The Directory: Models
Reference number
ISO/IEC 9594-2:2020(E)
ISO/IEC 2020
---------------------- Page: 1 ----------------------
ISO/IEC 9594-2:2020(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2020

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2020 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 9594-2:2020(E)
Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical

Commission) form the specialized system for worldwide standardization. National bodies that are

members of ISO or IEC participate in the development of International Standards through technical

committees established by the respective organization to deal with particular fields of technical activity.

ISO and IEC technical committees collaborate in fields of mutual interest. Other international

organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the

work.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of document should be noted (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details

of any patent rights identified during the development of the document will be in the Introduction and/or

on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC list of patent

declarations received (see http://patents.iec.ch).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see

www.iso.org/iso/foreword.html.

This document was prepared by ITU-T as ITU-T X.501 (10/2019) and drafted in accordance with

its editorial rules, in collaboration with Joint Technical Committee ISO/IEC JTC 1,

Information technology, Subcommittee SC 6, Telecommunications and information exchange between

systems.

This ninth edition cancels and replaces the eighth edition (ISO/IEC 9594-2:2017), which has been

technically revised.
A list of all parts in the ISO/IEC 9594 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body.

A complete listing of these bodies can be found at www.iso.org/members.html.
© ISO/IEC 2020 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 9594-2:2020 (E)
CONTENTS
Page

SECTION 1 – GENERAL ......................................................................................................................................... 1

1 Scope .............................................................................................................................................................. 1

2 References ...................................................................................................................................................... 2

2.1 Normative references .......................................................................................................................... 2

2.2 Non-normative references ................................................................................................................... 3

3 Definitions ...................................................................................................................................................... 3

3.1 Communication definitions ................................................................................................................. 3

3.2 Basic Directory definitions .................................................................................................................. 3

3.3 Distributed operation definitions ......................................................................................................... 3

3.4 Replication definitions ........................................................................................................................ 3

4 Abbreviations ................................................................................................................................................. 4

5 Conventions .................................................................................................................................................... 5

SECTION 2 – OVERVIEW OF THE DIRECTORY MODELS .............................................................................. 6

6 Directory Models ............................................................................................................................................ 6

6.1 Definitions ........................................................................................................................................... 6

6.2 The Directory and its users .................................................................................................................. 6

6.3 Directory and DSA Information Models ............................................................................................. 7

6.4 Directory Administrative Authority Model ......................................................................................... 7

SECTION 3 – MODEL OF DIRECTORY USER INFORMATION ........................................................................ 9

7 Directory Information Base ............................................................................................................................ 9

7.1 Definitions ........................................................................................................................................... 9

7.2 Objects ................................................................................................................................................ 10

7.3 Directory entries .................................................................................................................................. 10

7.4 Directory Information Tree (DIT) ....................................................................................................... 10

8 Directory entries ............................................................................................................................................. 11

8.1 Definitions ........................................................................................................................................... 11

8.2 Overall structure .................................................................................................................................. 13

8.3 Object classes ...................................................................................................................................... 14

8.4 Attribute types ..................................................................................................................................... 16

8.5 Attribute values ................................................................................................................................... 16

8.6 Attribute type hierarchies .................................................................................................................... 16

8.7 Friend attributes .................................................................................................................................. 17

8.8 Contexts .............................................................................................................................................. 17

8.9 Matching rules ..................................................................................................................................... 18

8.10 Entry collections .................................................................................................................................. 21

8.11 Compound entries and families of entries ........................................................................................... 22

9 Names ............................................................................................................................................................. 23

9.1 Definitions ........................................................................................................................................... 23

9.2 Names in general ................................................................................................................................. 23

9.3 Relative distinguished name ................................................................................................................ 23

9.4 Name matching ................................................................................................................................... 24

9.5 Distinguished names ........................................................................................................................... 24

9.6 Alias names ......................................................................................................................................... 25

10 Hierarchical groups ........................................................................................................................................ 25

10.1 Definitions ........................................................................................................................................... 25

10.2 Hierarchical relationship ..................................................................................................................... 26

10.3 Sequential ordering of a hierarchical group ........................................................................................ 26

SECTION 4 – DIRECTORY ADMINISTRATIVE MODEL ................................................................................... 28

11 Directory Administrative Authority model .................................................................................................... 28

11.1 Definitions ........................................................................................................................................... 28

© ISO/IEC 2020 – All rights reserved
Rec. ITU-T X.501 (10/2019) v
---------------------- Page: 4 ----------------------
ISO/IEC 9594-2:2020 (E)
Page

11.2 Overview ............................................................................................................................................. 28

11.3 Policy .................................................................................................................................................. 29

11.4 Specific administrative authorities ...................................................................................................... 29

11.5 Administrative areas and administrative points .................................................................................. 30

11.6 DIT Domain policies ........................................................................................................................... 32

11.7 DMD policies ...................................................................................................................................... 32

SECTION 5 – MODEL OF DIRECTORY ADMINISTRATIVE AND OPERATIONAL INFORMATION ......... 34

12 Model of Directory Administrative and Operational Information .................................................................. 34

12.1 Definitions ........................................................................................................................................... 34

12.2 Overview ............................................................................................................................................. 34

12.3 Subtrees ............................................................................................................................................... 35

12.4 Operational attributes .......................................................................................................................... 37

12.5 Entries ................................................................................................................................................. 37

12.6 Subentries ............................................................................................................................................ 38

12.7 Information model for collective attributes ......................................................................................... 39

12.8 Information model for context defaults ............................................................................................... 40

SECTION 6 – THE DIRECTORY SCHEMA .......................................................................................................... 41

13 Directory Schema ........................................................................................................................................... 41

13.1 Definitions ........................................................................................................................................... 41

13.2 Overview ............................................................................................................................................. 41

13.3 Object class definition ......................................................................................................................... 43

13.4 Attribute type definition ...................................................................................................................... 45

13.5 Matching rule definition ...................................................................................................................... 48

13.6 Relaxation and tightening .................................................................................................................... 50

13.7 DIT structure definition ....................................................................................................................... 56

13.8 DIT content rule definition .................................................................................................................. 59

13.9 Context type definition ........................................................................................................................ 60

13.10 DIT Context Use definition ................................................................................................................. 61

13.11 Friends definition ................................................................................................................................ 62

13.12 Syntax definitions ................................................................................................................................ 63

14 Directory System Schema .............................................................................................................................. 63

14.1 Overview ............................................................................................................................................. 63

14.2 System schema supporting the administrative and operational information model ............................ 63

14.3 System schema supporting the administrative model .......................................................................... 64

14.4 System schema supporting general administrative and operational requirements .............................. 65

14.5 System schema supporting access control ........................................................................................... 67

14.6 System schema supporting the collective attribute model ................................................................... 67

14.7 System schema supporting context assertion defaults ......................................................................... 67

14.8 System schema supporting the service administration model ............................................................. 68

14.9 System schema supporting password administration .......................................................................... 68

14.10 System schema supporting hierarchical groups................................................................................... 69

14.11 Maintenance of system schema ........................................................................................................... 70

14.12 System schema for first-level subordinates ......................................................................................... 71

15 Directory schema administration .................................................................................................................... 71

15.1 Overview ............................................................................................................................................. 71

15.2 Policy objects ...................................................................................................................................... 71

15.3 Policy parameters ................................................................................................................................ 71

15.4 Policy procedures ................................................................................................................................ 72

15.5 Subschema modification procedures ................................................................................................... 72

15.6 Entry addition and modification procedures ....................................................................................... 73

15.7 Subschema policy attributes ................................................................................................................ 73

SECTION 7 – DIRECTORY SERVICE ADMINISTRATION ................................................................................ 79

16 Service Administration Model........................................................................................................................ 79

© ISO/IEC 2020 – All rights reserved
vi Rec. ITU-T X.501 (10/2019)
---------------------- Page: 5 ----------------------
ISO/IEC 9594-2:2020 (E)
Page

16.1 Definitions ........................................................................................................................................... 79

16.2 Service-type/user-class model ............................................................................................................. 79

16.3 Service-specific administrative areas .................................................................................................. 80

16.4 Introduction to search-rules ................................................................................................................. 81

16.5 Subfilters ............................................................................................................................................. 81

16.6 Filter requirements .............................................................................................................................. 82

16.7 Attribute information selection based on search-rules ........................................................................ 82

16.8 Access control aspects of search-rules ................................................................................................ 83

16.9 Contexts aspects of search-rules .......................................................................................................... 83

16.10 Search-rule specification ..................................................................................................................... 83

16.11 Matching restriction definition ............................................................................................................ 91

16.12 Search-validation function .................................................................................................................. 91

SECTION 8 – SECURITY ........................................................................................................................................ 93

17 Security model ................................................................................................................................................ 93

17.1 Definitions ........................................................................................................................................... 93

17.2 Security policies .................................................................................................................................. 93

17.3 Protection of Directory operations ...................................................................................................... 94

18 Basic Access Control ...................................................................................................................................... 95

18.1 Scope and application.......................................................................................................................... 95

18.2 Basic Access Control model ............................................................................................................... 95

18.3 Access control administrative areas .................................................................................................... 98

18.4 Representation of Access Control Information ................................................................................... 100

18.5 ACI operational attributes ................................................................................................................... 105

18.6 Protecting the ACI ............................................................................................................................... 106

18.7 Access control and Directory operations ............................................................................................. 106

18.8 Access Control Decision Function ...................................................................................................... 106

18.9 Simplified Access Control .................................................................................................................. 108

19 Rule-based Access Control ............................................................................................................................. 108

19.1 Scope and application.......................................................................................................................... 108

19.2 Rule-based Access Control model ...................................................................................................... 108

19.3 Access control administrative areas .................................................................................................... 109

19.4 Security Label ..................................................................................................................................... 109

19.5 Clearance ............................................................................................................................................. 110

19.6 Access Control and Directory operations ............................................................................................ 111

19.7 Access Control Decision Function ...................................................................................................... 111

19.8 Use of Rule-based and Basic Access Control ..................................................................................... 112

20 Data Integrity in Storage ................................................................................................................................ 112

20.1 Introduction ......................................................................................................................................... 112

20.2 Protection of an Entry or Selected Attribute Types ............................................................................. 112

20.3 Context for Protection of a Single Attribute Value ............................................................................. 114

SECTION 9 – DSA MODELS .................................................................................................................................. 115

21 DSA Models ................................................................................................................................................... 115

21.1 Definitions ........................................................................................................................................... 115

21.2 Directory Functional Model ................................................................................................................ 115

21.3 Directory Distribution Model .............................................................................................................. 116

SECTION 10 – DSA INFORMATION MODEL ...................................................................................................... 118

22 Knowledge...................................................................................................................................................... 118

22.1 Definitions ........................................................................................................................................... 118

22.2 Introduction ......................................................................................................................................... 118

22.3 Knowledge References ........................................................................................................................ 119

22.4 Minimum Knowledge ......................................................................................................................... 121

22.5 First Level DSAs ................................................................................................................................. 121

22.6 Knowledge references to LDAP servers ............................................................................................. 122

© ISO/IEC 2020 – All rights reserved
Rec. ITU-T X.501 (10/2019) vii
---------------------- Page: 6 ----------------------
ISO/IEC 9594-2:2020 (E)
Page

23 Basic Elements of the DSA Information Model ............................................................................................. 122

23.1 Definitions ........................................................................................................................................... 122

23.2 Introduction ......................................................................................................................................... 122

23.3 DSA Specific Entries and their Names ............................................................................................... 123

23.4 Basic Elements .................................................................................................................................... 124

24 Representation of DSA Information ............................................................................................................... 125

24.1 Representation of Directory User and Operational Information ......................................................... 126

24.2 Representation of Knowledge References ........................................................................................... 126

24.3 Representation of Names and Naming Contexts ................................................................................. 133

SECTION 11 – DSA OPERATIONAL FRAMEWORK .......................................................................................... 135

25 Overview ........................................................................................................................................................ 135

25.1 Definitions ........................................................................................................................................... 135

25.2 Introduction ......................................................................................................................................... 135

26 Operational bindings ..................................
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.