Subject: Long: Ryan Moat's Promised ABNF for Core Schema Doc

From: Ed Ellesson <[email-masked]>
Date: Tue, 20 Jul 1999 11:14:27 -0400

This is from Ryan Moats.  I am posting this for him until we work out the
address issue that caused his posting to bounce.  

**************************************************

From: "Ryan Moats" <[email-masked]>
To: "Policy Mailing List" <[email-masked]>
Subject: LONG (>1K lines): Promised ABNF for Core Schema document...
Date: Tue, 20 Jul 1999 07:12:04 -0500
Message-Id:
<[email-masked]>
Mime-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-Msmail-Priority: Normal
X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0
X-Mimeole: Produced By Microsoft MimeOLE V4.72.3155.0
Importance: Normal

First, my apologies to anybody who sees this twice.
I haven't seen it in the policy archives, so I'm
not sure it got distributed (I hope this isn't a
mail list problem).

Also, I'm on vacation until 7/26, so I won't be
replying to comments until then...

Policy fans-

Here is the ABNF text changes for draft-ietf-policy-core-schema-04
that I promised during the working group meeting in Oslo.

I've got some issues and explanation that I'll summarize here

- all constructs <oid-??#> imply an OID to be assigned. The ?? indicates
  family (for separate arcs) and # is the number.
- In change 2 cn is defined in X.500, rather than define here, it
  needs a reference to RFC 2256.
- The reason changes 3 on looks so complex is that the "AUXILIARY"
  construct is captured in LDAP and X.500 through the use of content
  rules.  Further, the "POSSIBLE SUPERIORS" construct is captured
  through the use of name form rules and structural rules.  For
  each attribute that can function as an RDN, you need a separate
  name form and structural rule.  Finally, the containerStructuralRule
  needs to point at object class container, which is a MicroSoft definition
  that I don't have the OID of.  Do we really want this?
- In change 4, there is no way to define default values for LDAP attributes
  in the schema ABNF.  The default information specified is only
  useful for a management tool and should be moved to a separate section
  or discussion paragraph.
- Using Formatted strings to implement ordering for things with DNs
  policyRuleConditionList, policyRuleActionList, ... is not the right
  approach.  It requires the client to process all strings in the
  response before it can make another LDAP request based on the
  embedded DN as well as a discussion of what the client is supposed
  to do if a returned string is not formatted correctly.  A better
  implementation is to use a separate object class to replace this
  attribute, with the formatted portions of the string being
  attributes.  These separate objects are grouped under the policyRule
  object via DIT containment rules.  The rules supplied take this
  alternate approach.
- Further, in changes 5,6 you cannot specify a possible superior for
  an auxiliary class.  Therefore, that specification has been
  ignored.

It is awfully long, but ABNF can get pretty verbose.

Ryan

============changes

1. replace

     NAME             policy
     DESCRIPTION      An abstract class with four attributes for
                      describing a policy-related instance.
     DERIVED FROM     top
     TYPE             abstract
     AUXILIARY CLASSES    none
     OID              <to be assigned>
     MAY              cn caption description policyKeywords

with

     ( <oid-oc1> NAME 'policy'
       DESC 'An abstract class with four attributes for describing
	     a policy-related instance.'
       SUP top
       ABSTRACT
       MAY (cn $ caption $ description $ policyKeywords)
     )

2. replace

     NAME             caption
     DESCRIPTION      A one-line description of this policy-related
                      object.
     SYNTAX           IA5String

     OID              <to be assigned>
     EQUALITY         caseExactIA5Match
     SINGLE-VALUED

     NAME             description
     DESCRIPTION      A long description of this policy-related object.
     SYNTAX           IA5String
     OID              <to be assigned>
     EQUALITY         caseExactIA5Match
     SINGLE-VALUED

     NAME             policyKeywords
     DESCRIPTION      A set of keywords to assist directory clients in
                      locating the policy objects applicable to them.
                      Standard keyword values are listed in the Policy
                      Core Information Model document.
     SYNTAX           IA5String
     OID              <to be assigned>
     EQUALITY         caseExactIA5Match
     MULTI-VALUED

with
     ( <oid-at1> NAME 'caption'
       DESC 'A one-line description of this policy-related object.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

     ( <oid-at2> NAME 'description'
       DESC 'A long description of this policy-related object.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

     ( <oid-at3> NAME 'policyKeywords'
       DESC 'A set of keywords to assist directory clients in locating
	     the policy objects applicable to them. Standard keyword
	     values are listed in the Policy Core Information Model
	     document.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
     )

3. replace

     NAME             policyGroup
     DESCRIPTION      A container for either a set of related policyRules
                      or a set of related policyGroups.
     DERIVED FROM     top
     TYPE             structural
     AUXILIARY CLASSES    policyGroupContainmentAuxClass,
                      policyRuleContainmentAuxClass
     POSSIBLE SUPERIORS   container, organization, organizationalUnit,
                      policyGroup
     OID              <to be assigned>
     MUST             policyGroupName

   The one attribute of PolicyGroup is defined as:

     NAME             policyGroupName
     DESCRIPTION      The user-friendly name of this policy group.
     SYNTAX           IA5String
     OID              <to be assigned>
     EQUALITY         caseExactIA5Match
     SINGLE-VALUED

with

     ( <oid-oc2> NAME 'policyGroup'
       DESC 'A container for either a set of related policyRules or a
             set of related policyGroups.'
       SUP top
       MUST (policyGroupName)
     )

     ( <oid-cr1>
       NAME 'policyGroupContentRule'
       DESC 'shows what auxiliary classes go with policyGroup'
       AUX (policyGroupContainmentAuxClass $ policyRuleContainmentAuxClass)
     )

     ( <oid-nf1> NAME 'policyGroupNameForm'
       OC policyGroup
       MUST (cn)
     )

     ( 1 NAME 'policyGroupStructuralRule'
       FORM policyGroupNameForm
       SUP 2 3 4 1
     )

     ( <oid-nf2> NAME 'policyGroupNameForm'
       OC policyGroup
       MUST (policyGroupName)
     )

     ( 5 NAME 'policyGroupStructuralRule2'
       FORM policyGroupNameForm
       SUP 2 3 4 5
     )

     ( 2 NAME 'containerStructuralRule'
       FORM ?container object class is MicroSoft specific?
     )

     ( 3 NAME 'organizationStructuralRule'
       FORM 2.5.15.3
     )

     ( 4 NAME 'organizationalUnitStructuralRule'
       FORM 2.5.15.4
     )

   The one attribute of PolicyGroup is defined as:

     ( <oid-at4> NAME 'policyGroupName'
       DESC 'The user-friendly name of this policy group.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

4. Replace

     NAME             policyRule
     DESCRIPTION      The central class for representing the "If
                      Condition then Action" semantics associated with a
                      policy rule.
     DERIVED FROM     top
     TYPE             structural
     AUXILIARY CLASSES    none
     POSSIBLE SUPERIORS   policyGroup
     OID              <to be assigned>
     MUST             policyRuleName
     MAY              policyRuleEnabled policyRuleConditionListType
                      policyRuleConditionList policyRuleActionList
                      policyRuleValidityPeriodList policyRuleUsage
                      policyRulePriority policyRuleMandatory
                      policyRuleSequencedActions

   The attributes of policyRule are as follows:

     NAME             policyRuleName
     DESCRIPTION      The user-friendly name of this policy rule.
     SYNTAX           IA5String
     OID              <to be assigned>
     EQUALITY         caseExactIA5Match
     SINGLE-VALUED
     NAME             policyRuleEnabled
     DESCRIPTION      An enumeration indicating whether a policy rule is
                      administratively enabled, administratively
                      disabled, or enabled for debug mode.  The defined
                      values for this attribute are enabled(1),
                      disabled(2), and enabledForDebug(3).
     SYNTAX           INTEGER
     OID              <to be assigned>
     EQUALITY         integerMatch
     SINGLE-VALUED
     DEFAULT VALUE    enabled(1)

     NAME             policyRuleConditionListType
     DESCRIPTION      Indicates whether the list of policy conditions
                      associated with this policy rule is in disjunctive
                      normal form (DNF) or conjunctive normal form (CNF).
                      Defined values are DNF(1) and CNF(2).
     SYNTAX           INTEGER
     OID              <to be assigned>
     EQUALITY         integerMatch
     SINGLE-VALUED
     DEFAULT VALUE    DNF(1)

     NAME             policyRuleConditionList
     DESCRIPTION      An unordered list of strings of the form
                      '<groupNumber>:<+|->:<DN>', indicating a set of
                      policy conditions that determine when the
                      policyRule is applicable.
     SYNTAX           DirectoryString
     OID              <to be assigned>
     EQUALITY         caseIgnoreSubstringsMatch
     MULTI-VALUED
     FORMAT           <groupNumber>:<+|->:<DN>

     NAME             policyRuleActionList
     DESCRIPTION      An unordered list of strings of the form 'n:DN',
                      indicating an ordered set of policy actions to be

                      performed if the associated condition(s) of the
                      policyRule evaluates to true.
     SYNTAX           DirectoryString
     OID              <to be assigned>
     EQUALITY         caseIgnoreSubstringsMatch
     MULTI-VALUED
     FORMAT           n:DN

     NAME             policyRuleValidityPeriodList
     DESCRIPTION      Distinguished names of policyTimePeriodConditions
                      that determine when the policyRule is scheduled to
                      be active / inactive.  No order is implied.
     SYNTAX           DN
     OID              <to be assigned>
     EQUALITY         distinguishedNameMatch
     MULTI-VALUED

     NAME             policyRuleUsage
     DESCRIPTION      This attribute is used to provide guidelines on how
                      this policy should be used.
     SYNTAX           DirectoryString
     OID              <to be assigned>
     EQUALITY         caseIgnoreMatch
     SINGLE-VALUED

     NAME             policyRulePriority
     DESCRIPTION      A non-negative integer for prioritizing this
                      policyRule relative to other policyRules.  A larger
                      value indicates a higher priority.
     SYNTAX           INTEGER
     OID              <to be assigned>
     EQUALITY         integerMatch
     SINGLE-VALUED
     DEFAULT VALUE    0

     NAME             policyRuleMandatory
     DESCRIPTION      A flag indicating that the evaluation of the
                      policyConditions and execution of policyActions (if
                      the condition list evaluates to True) is required.
     SYNTAX           Boolean
     OID              <to be assigned>
     EQUALITY         booleanMatch
     SINGLE-VALUED
     DEFAULT VALUE    TRUE

     NAME             policyRuleSequencedActions
     DESCRIPTION      An enumeration indicating how to interpret the
                      action ordering indicated via the
                      policyRuleActionList attribute.  The defined values
                      for this attribute are mandatory(1),
                      recommended(2), and dontCare(3).

     SYNTAX           INTEGER
     OID              <to be assigned>
     EQUALITY         integerMatch
     SINGLE-VALUED
     DEFAULT VALUE    dontCare(3)

with
     ( <oid-oc3> NAME 'policyRule'
       DESC 'The central class for representing the "If Condition then
Action" semantics associated with a policy rule.'
       SUP top
       MUST (policyRuleName)
       MAY (policyRuleEnabled $ policyRuleConditionListType $
	    policyRuleValidityPeriodList $ policyRuleUsage $
            policyRulePriority $ policyRuleMandatory $
            policyRuleSequencedActions)
     )

     ( <oid-nf3> NAME 'policyRuleNameForm'
       OC policyRule
       MUST (cn)
     )

     ( 6 NAME 'policyRuleStructuralRule'
         FORM policyRuleNameForm
         SUP 5
     )

     ( <oid-nf4> NAME 'policyRuleNameForm'
       OC policyRule
       MUST (policyRuleName)
     )

     ( 7 NAME 'policyRuleStructuralRule2'
         FORM policyRuleNameForm
         SUP 5

     )

     ( <oid-at5> NAME 'policyRuleName'
       DESC 'The user-friendly name of this policy rule.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

     ( <oid-at6> NAME 'policyRuleEnabled'
       DESC 'An enumeration indicating whether a policy rule is
             administratively enabled, administratively disabled, or enabled
             for debug mode. The defined values for this attribute are
             enabled(1), disabled(2), and enabledForDebug(3).'
       SYNTAX INTEGER
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at7> NAME 'policyRuleConditionListType'
       DESC 'Indicates whether the list of policy conditions
             associated with this policy rule is in disjunctive normal
             form (DNF) or conjunctive normal form (CNF). Defined
	     values are DNF(1) and CNF(2).'
       SYNTAX INTEGER
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at8> NAME 'policyRuleValidityPeriodList'
       DESC 'An unordered list of strings of the form "n:DN",
             indicating an ordered set of policy actions to be performed if
	     the associated condition(s) of the policyRule evaluates to
	     true.'
       SYNTAX DirectoryString
       EQUALITY caseIgnoreSubstringsMatch
     )

     ( <oid-at9> NAME 'policyRuleUsage'
       DESC 'This attribute is used to provide guidelines on how this
             policy should be used.'
       SYNTAX DirectoryString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at10> NAME 'policyRulePriority'
       DESC 'A non-negative integer for prioritizing this policyRule
             relative to other policyRules. A larger value indicates a
	     higher priority.'
       SYNTAX INTEGER
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at11> NAME 'policyRuleMandatory'
       DESC 'A flag indicating that the evaluation of the
             policyConditions and execution of policyActions (if the
	     condition list evaluates to True) is required.'
       SYNTAX Boolean
       EQUALITY booleanMatch
       SINGLE-VALUE
     )

     ( <oid-at12> NAME 'policyRuleSequencedActions'
       DESC 'An enumeration indicating how to interpret the action
             ordering indicated via the policyRuleActionList
             attribute. The defined values for this attribute are
             mandatory(1), recommended(2), and dontCare(3).'
       SYNTAX Boolean
       EQUALITY booleanMatch
     )

     ( <oid-oc4> NAME 'policyRuleConditionItem'
       DESC 'The class contains attributes indicating a set of policy
             conditions that determine when the policyRule is
             applicable.'
       SUP top
       MUST (policyRuleItemGroupNumber $ policyRuleItemNegated $
             policyRuleItemDN $ policyRuleConditionItemName)
     )

     ( <oid-nf5> NAME 'policyRuleConditionItemNameForm'
       OC policyRuleConditionItem
       MUST (cn)
     )

     ( 8 NAME 'policyRuleConditionItemStructuralRule'
       FORM policyRuleConditionItemNameForm
       SUP 7
     )

     ( <oid-nf6> NAME 'policyRuleConditionItemNameForm'
       OC policyRuleConditionItem
       MUST (policyRuleConditionItemName)
     )

     ( 9 NAME 'policyRuleConditionItemStructuralRule2'
       FORM policyRuleConditionItemNameForm
       SUP 7
     )

     ( <oid-at13>
       NAME 'policyRuleConditionItemName'
       DESC 'a user-friendly name for the policyRuleItem'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

     ( <oid-at14>
       NAME 'policyRuleItemGroupNumber'
       DESC 'The group number a policyRuleConditionItem or
             policyRuleActionItem is a member of'
       SYNTAX INTEGER
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at15>
       NAME 'policyRuleItemNegated'
       DESC 'Indicates if a policyRuleConditionItem is negated TRUE =
             negation'
       SYNTAX BOOLEAN
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at16>
       NAME 'policyRuleItemDN'
       DESC 'a DN pointer to the policy condition or policy action'
       SYNTAX DN
       EQUALITY distinguishedNameMatch
       SINGLE-VALUE
     )

     ( <oid-oc5> NAME 'policyRuleActionItem'
       DESC 'The class contains attributes indicating a set of policy
             actions to be performed if the associated condition(s) of the
             policy Rule evaluates to true.'
       SUP top
       MUST (policyRuleItemGroupNumber $ policyRuleItemDN $
             policyRuleActionItemName)
     )

     ( <oid-nf7> NAME 'policyRuleActionItemNameForm'
       OC policyRuleActionItem
       MUST (cn)
     )

     ( 10 NAME 'policyRuleActionItemStructuralRule'
       FORM policyRuleActionItemNameForm
       SUP 7
     )

     ( <oid-nf8> NAME 'policyRuleActionItemNameForm'
       OC policyRuleActionItem
       MUST (policyRuleActionItemName)
     )

     ( 11 NAME 'policyRuleActionItemStructuralRule2'
       FORM policyRuleActionItemNameForm
       SUP 7
     )

     ( <oid-at17>
       NAME 'policyRuleActionItemName'
       DESC 'a user-friendly name for the policyRuleItem'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

5. Replace

     NAME             policyCondition
     DESCRIPTION      A class representing a condition to be evaluated in
                      conjunction with a policy rule.
     DERIVED FROM     top
     TYPE             auxiliary
     AUXILIARY CLASSES    none
     POSSIBLE SUPERIORS   policyRule
     OID              <to be assigned>
     MUST             policyConditionName
     MAY

   The one attribute definition is as follows:

     NAME             policyConditionName
     DESCRIPTION      The user-friendly name of this policy condition.
     SYNTAX           IA5String
     OID              <to be assigned>
     EQUALITY         caseExactIA5Match
     SINGLE-VALUED

with

     ( <oid-oc6> NAME 'policyCondition'
       DESC 'A class representing a condition to be evaluated in
             conjunction with a policy rule.'
       SUP top
       AUXILIARY
       MUST (policyConditionName)
     )

     ( <oid-at18>
       NAME 'policyConditionName'
       DESC 'The user-friendly name of this policy condition.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

6. Replace

     NAME             policyTimePeriodCondition
     DESCRIPTION      A class that provides the capability of enabling /
                      disabling a policy rule according to a pre-
                      determined schedule.
     DERIVED FROM     policyCondition
     TYPE             auxiliary
     AUXILIARY CLASSES    none
     POSSIBLE SUPERIORS   policyRule
     OID              <to be assigned>
     MUST
     MAY              ptpConditionTime ptpConditionMonthOfYearMask
                      ptpConditionDayOfMonthMask
                      ptpConditionDayOfWeekMask ptpConditionTimeOfDayMask
                      ptpConditionTimeZone

   The attributes of policyTimePeriodCondition are defined as follows:

     NAME             ptpConditionTime
     DESCRIPTION      The range of calendar dates on which a policy rule
                      is valid.
     SYNTAX           PrintableString
     OID              <to be assigned>
     EQUALITY         caseIgnoreMatch
     SINGLE-VALUED
     FORMAT           [yyyymmddhhmmss]:[yyyymmddhhmmss]

     NAME             ptpConditionMonthOfYearMask
     DESCRIPTION      A mask identifying the months of the year in which
                      a policy rule is valid.
     SYNTAX           Printable String
     OID              <to be assigned>
     EQUALITY         caseIgnoreMatch
     SINGLE-VALUED
     FORMAT           A string of 12 ASCII '0's and '1's.

     NAME             ptpConditionDayOfMonthMask
     DESCRIPTION      A mask identifying the days of the month on which a
                      policy rule is valid.
     SYNTAX           PrintableString
     OID              <to be assigned>
     EQUALITY         caseIgnoreMatch
     SINGLE-VALUED
     FORMAT           A string of 31 ASCII '0's and '1's.

     NAME             ptpConditionDayOfWeekMask
     DESCRIPTION      A mask identifying the days of the week on which a
                      policy rule is valid.
     SYNTAX           PrintableString
     OID              <to be assigned>
     EQUALITY         caseIgnoreMatch
     SINGLE-VALUED
     FORMAT           A string of 7 ASCII '0's and '1's.

     NAME             ptpConditionTimeOfDayMask
     DESCRIPTION      The range of times at which a policy rule is valid.
                      If the second time is earlier than the first, then
                      the interval spans midnight.
     SYNTAX           Printable String
     OID              <to be assigned>
     EQUALITY         caseIgnoreMatch
     SINGLE-VALUED
     FORMAT           hhmmss:hhmmss

     NAME             ptpConditionTimeZone
     DESCRIPTION      The definition of the time zone for the
                      policyTimePeriodCondition.
     SYNTAX           PrintableString
     OID              <to be assigned>
     EQUALITY         caseIgnoreMatch
     SINGLE-VALUED
     FORMAT           either 'Z' (UTC) or <'+'|'-'><hhmm>

with

     ( <oid-oc7> NAME 'policyTimePeriodCondition'
       DESC 'A class that provides the capability of enabling /
             disabling a policy rule according to a pre- determined
	     schedule.'
       SUP policyCondition
       AUXILIARY
       MAY (ptpConditionTime $ ptpConditionMonthOfYearMask $
            ptpConditionDayOfMonthMask $ ptpConditionDayOfWeekMask $
	    ptpConditionTimeOfDayMask $ ptpConditionTimeZone)
     )

     ( <oid-at19>
       NAME 'ptpConditionTime'
       DESC 'The range of calendar dates on which a policy rule is valid.'
       SYNTAX PrintableString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at20>
       NAME 'ptpConditionMonthOfYearMask'
       DESC 'A mask identifying the months of the year in which a
             policy rule is valid.'
       SYNTAX Printable
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at21>
       NAME 'ptpConditionDayOfMonthMask'
       DESC 'A mask identifying the days of the month on which a
             policy rule is valid.'
       SYNTAX PrintableString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at22>
       NAME 'ptpConditionDayOfWeekMask'
       DESC 'A mask identifying the days of the week on which a policy
             rule is valid.'
       SYNTAX PrintableString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at23>
       NAME 'ptpConditionTimeOfDayMask'
       DESC 'The range of times at which a policy rule is valid. If
             the second time is earlier than the first, then the interval
             spans midnight.'
       SYNTAX Printable
       EQUALITY caseIgnoreMatch
     )

     ( <oid-at24>
       NAME 'ptpConditionTimeZone'
       DESC 'The definition of the time zone for the
             policyTimePeriodCondition.'
       SYNTAX PrintableString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

7. Replace

     NAME             vendorPolicyCondition
     DESCRIPTION      A class that defines a registered means to describe
                      a policy condition.
     DERIVED FROM     policyCondition
     TYPE             auxiliary
     AUXILIARY CLASSES    none
     POSSIBLE SUPERIORS   policyRule
     OID              <to be assigned>
     MUST             vendorPolicyConstraintData
                      vendorPolicyConstraintEncoding
     MAY

   The attribute definitions for vendorPolicyCondition are as follows:

     NAME             vendorPolicyConstraintData
     DESCRIPTION      Escape mechanism for representing constraints that
                      have not been modeled as specific attributes. The
                      format of the values is identified by the OID
                      stored in the attribute
                      vendorPolicyConstraintEncoding.
     SYNTAX           OctetString
     OID              <to be assigned>
     EQUALITY         octetStringMatch
     MULTI-VALUED

     NAME             vendorPolicyConstraintEncoding
     DESCRIPTION      An OID identifying the format and semantics for
                      this instance's vendorPolicyConstraintData

                      attribute.
     SYNTAX           OID
     OID              <to be assigned>
     EQUALITY         objectIdentifierMatch
     SINGLE-VALUED

with

     ( <oid-oc8> NAME 'vendorPolicyCondition'
       DESC 'A class that defines a registered means to describe a
	     policy condition.'
       SUP policyCondition
       AUXILIARY
       MUST (vendorPolicyConstraintData $
	     vendorPolicyConstraintEncoding)
     )

     ( <oid-at25>
       NAME 'vendorPolicyConstraintData'
       DESC 'Escape mechanism for representing constraints that have
	    not been modeled as specific attributes. The format of the
	    values is identified by the OID stored in the attribute
	    vendorPolicyConstraintEncoding.'
       SYNTAX OctetString
       EQUALITY octetStringMatch
     )

     ( <oid-at26>
       NAME 'vendorPolicyConstraintEncoding'
       DESC 'An OID identifying the format and semantics for this
             instance"s vendorPolicyConstraintData attribute.'
       SYNTAX OID
       EQUALITY objectIdentifierMatch
       SINGLE-VALUE
     )

8. Replace

     NAME             policyAction
     DESCRIPTION      A class representing an action to be performed as a
                      result of a policy rule.
     DERIVED FROM     top
     TYPE             auxiliary
     AUXILIARY CLASSES    none
     POSSIBLE SUPERIORS   policyRule
     OID              <to be assigned>
     MUST             policyActionName
     MAY

   The one attribute definition is as follows:

     NAME             policyActionName
     DESCRIPTION      The user-friendly name of this policy action.
     SYNTAX           IA5String
     OID              <to be assigned>
     EQUALITY         caseExactIA5Match
     SINGLE-VALUED

with

     ( <oid-oc9> NAME 'policyAction'
       DESC 'A class representing an action to be performed as a
             result of a policy rule.'
       SUP top
       AUXILIARY
       MUST (policyActionName)
     )

     ( <oid-at27>
       NAME 'policyActionName'
       DESC 'The user-friendly name of this policy action.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

9. Replace

     NAME             vendorPolicyAction
     DESCRIPTION      A class that defines a registered means to describe
                      a policy action.
     DERIVED FROM     policyAction
     TYPE             auxiliary
     AUXILIARY CLASSES    none
     POSSIBLE SUPERIORS   policyRule
     OID              <to be assigned>
     MUST             vendorPolicyActionData vendorPolicyActionEncoding
     MAY

   The attribute definitions for vendorPolicyAction are as follows:

     NAME             vendorPolicyActionData
     DESCRIPTION      Escape mechanism for representing actions that have
                      not been modeled as specific attributes. The
                      format of the values is identified by the OID
                      stored in the attribute vendorPolicyActionEncoding.
     SYNTAX           OctetString
     OID              <to be assigned>
     EQUALITY         octetStringMatch
     MULTI-VALUED

     NAME             vendorPolicyActionEncoding
     DESCRIPTION      An OID identifying the format and semantics for
                      this instance's vendorPolicyActionData attribute.
     SYNTAX           OID
     OID              <to be assigned>
     EQUALITY         objectIdentifierMatch
     SINGLE-VALUED

with

     ( <oid-oc10> NAME 'vendorPolicyAction'
       DESC 'A class that defines a registered means to describe a
             policy action.'
       SUP policyAction
       AUXILIARY
       MUST (vendorPolicyActionData $ vendorPolicyActionEncoding)
     )

     ( <oid-at28>
       NAME 'vendorPolicyActionData'
       DESC 'Escape mechanism for representing actions that have not
	     been modeled as specific attributes. The format of the
	     values is identified by the OID stored in the attribute
	     vendorPolicyActionEncoding.'
       SYNTAX OctetString
       EQUALITY octetStringMatch
     )

     ( <oid-at29>
       NAME 'vendorPolicyActionEncoding'
       DESC 'An OID identifying the format and semantics for this
             instance"s vendorPolicyActionData attribute.'
       SYNTAX OID
       EQUALITY objectIdentifierMatch
       SINGLE-VALUE
     )

10. Replace

     NAME           policyInstance
     DESCRIPTION    A structural class to which the auxiliary classes
                    policyCondition and policyAction may be attached,
                    when the complex policy rule structure is required.
     DERIVED FROM   policy
     TYPE           structural
     AUXILIARY CLASSES    policyCondition, policyAction
     OID            <to be assigned>

with

     ( <oid-oc11> NAME 'policyInstance'
       DESC 'A structural class to which the auxiliary classes
	     policyCondition and policyAction may be attached, when
	     the complex policy rule structure is required.'
       SUP policy
     )

     ( <oid-cr2>
       NAME 'policyInstanceContentRule'
       DESC 'shows what auxiliary classes go with policyInstance'
       AUX (policyCondition $ policyAction)
     )

11. Replace

     NAME             policyElement
     DESCRIPTION      An auxiliary class used to tag instances of classes
                      defined outside the realm of policy as relevant to
                      a particular policy specification.
     DERIVED FROM     policy
     TYPE             auxiliary
     AUXILIARY CLASSES    none
     OID              <to be assigned>

with

     ( <oid-oc12> NAME 'policyElement'
       DESC 'An auxiliary class used to tag instances of classes
	     defined outside the realm of policy as relevant to a
	     particular policy specification.'
       SUP policy
       AUXILIARY
     )

12. Replace

     NAME             policySubtreesPtrAuxClass
     DESCRIPTION      An auxiliary class providing a DN pointer to roots
                      of DIT subtrees contained policy-related objects.
     DERIVED FROM     top
     TYPE             auxiliary
     AUXILIARY CLASSES    none
     OID              <to be assigned>
     MUST             policySubtreesAuxContainedSet

with

     ( <oid-oc13> NAME 'policySubtreesPtrAuxClass'
       DESC 'An auxiliary class providing a DN pointer to roots of DIT

             subtrees contained policy-related objects.'
       SUP top
       AUXILIARY
       MUST (policySubtreesAuxContainedSet)
     )

13. Replace

     NAME             policySubtreesAuxContainedSet
     DESCRIPTION      Distinguished names of objects that serve as roots
                      for DIT subtrees containing policy-related objects.
                      No order is implied.
     SYNTAX           DN
     OID              <to be assigned>
     EQUALITY         distinguishedNameMatch
     MULTI-VALUED

with

     ( <oid-at30>
       NAME 'policySubtreesAuxContainedSet'
       DESC 'Distinguished names of objects that serve as roots for
             DIT subtrees containing policy-related objects. No order
	     is implied.'
       SYNTAX DN
       EQUALITY distinguishedNameMatch
     )

14. Replace

     NAME                 policyGroupContainmentAuxClass
     DESCRIPTION          An auxiliary class used to bind policyGroups
                          to an appropriate container object.
     DERIVED FROM         top
     TYPE                 auxiliary
     AUXILIARY CLASSES    none
     OID                  <to be assigned>
     MUST                 policyGroupsAuxContainedSet

with

     ( <oid-oc14> NAME 'policyGroupContainmentAuxClass'
       DESC 'An auxiliary class used to bind policyGroups to an
             appropriate container object.'
       SUP top
       AUXILIARY
       MUST (policyGroupsAuxContainedSet)
     )

15. Replace

     NAME           policyGroupsAuxContainedSet
     DESCRIPTION    Distinguished names of policyGroups associated in
                    some way with the instance to which this attribute
                    has been appended.  No order is implied.
     SYNTAX         DN
     OID            <to be assigned>
     EQUALITY       distinguishedNameMatch
     MULTI-VALUED

with

     ( <oid-at31>
       NAME 'policyGroupsAuxContainedSet'
       DESC 'Distinguished names of policyGroups associated in some
             way with the instance to which this attribute has been
             appended. No order is implied.'
       SYNTAX DN
       EQUALITY distinguishedNameMatch
     )

16.  Replace

     NAME             policyRuleContainmentAuxClass
     DESCRIPTION      An auxiliary class used to bind policyRules to an
                      appropriate container object.
     DERIVED FROM     top
     TYPE             auxiliary
     AUXILIARY CLASSES    none
     OID              <to be assigned>
     MUST             policyRulesAuxContainedSet

with

     ( <oid-oc15> NAME 'policyRuleContainmentAuxClass'
       DESC 'An auxiliary class used to bind policyRules to an
             appropriate container object.'
       SUP top
       AUXILIARY
       MUST (policyRulesAuxContainedSet)
     )

17.  Replace

     NAME             policyRulesAuxContainedSet
     DESCRIPTION      Distinguished names of policyRules associated in
                      some way with the instance to which this attribute
                      has been appended.  No order is implied.
     SYNTAX           DN
     OID              <to be assigned>
     EQUALITY         distinguishedNameMatch

     MULTI-VALUED

with

     ( <oid-at32>
       NAME 'policyRulesAuxContainedSet'
       DESC 'Distinguished names of policyRules associated in some way
             with the instance to which this attribute has been
             appended. No order is implied.'
       SYNTAX DN
       EQUALITY distinguishedNameMatch
     )

Regards, 

Ed Ellesson
Sr. Engineer, TCP/IP Technology Management
IBM Networking Software Products
Research Triangle Park, NC 
[email-masked]
919-254-4115

---

From: "Ryan Moats" <[email-masked]>
Date: Mon, 26 Jul 1999 12:30:36 -0500

At the Oslo IETF, I promised ABNF for the core
schema document.  That's been included in
a previous mail.  Once the QoS schema
is relatively finalized, I'm willing to volunteer
ABNF for that as well.

I also volunteered schema versioning information
in Oslo. If the ABNF that I sent is accepted, then
schema versioning isn't as necessary.  That's because
the ABNF I sent does not use structured DNs.  Rather,
it uses DIT containment rules (which in LDAP are
specified on a one-level basis) to group the rule
and action items under the policy rule.

This still allows clients to pull all policy rule objects in a single LDAP
query (all policy item
objects will contain the RDN of the containing policy rule object) as well
as being in line with work items
in LDAPEXT and X.500 (as well as elsewhere).

Ryan

---

From: "Yoram Ramberg" <[email-masked]>
Date: Tue, 27 Jul 1999 11:34:26 -0500

Ryan - thanx much! We've been thinking about that and were hoping you'd be
willing to help.
Once the QoS schema is close to completion we'll get in touch. There are
certain modifications being considered to the core schema. The idea is to
follow up on recommendations made in Oslo and move some of the features
presented as part of the QoS schema to the core schema. We are working on
this proposal with Bob, Ed and John who are the authors of the core schema.

I hope that by the time of the next IETF meeting we'll have the revised
proposal (for core and QoS schemata and information models) where all the
schema definition is ABNF. Your help will be invaluable and appreciated.

On the switch from SDN to RDN containment:

This may be tricky. See if I got this one right.
Once you impose strict containment on the DIT you're also presenting a
restriction on relationships between rules and conditions relationships.
What happens is that your forcing me to place all conditions related to a
given rule under this rule in the DIT. What if another rule "wants" to use
one of those conditions? It must copy that condition (if it knows how to
find it) and place the copy unde the new rule. This makes that condition
non-reusable. Two identical conditions must be maintained now and could be
modified independently.

(I used conditions in my example because we deem conditions to be prime
candidate for reusability. Everyone wishing to create a reusable object
class and place it in the repository will have this problem exactly)

Furthermore: SDN provide syntax for specifying the intra-expression
relations, i.e., c1 AND c2 and NOT c3 or (NOT c4 abd C7). How would you
express this if you drop SDNs altogether? We, then, must add syntax for this
kind of expressions. RDN doesn't do the trick but atructured RDN still may
(still doesn't solve reusability).

It's quite probable that I just didn't undestand what you wrote and made a
big fuss out of nothing. Please, explain.

Thanx muxh,
*Yoram

---

From: "Ryan Moats" <[email-masked]>
Date: Tue, 27 Jul 1999 08:25:35 -0500

[Some editing to cut down B/W]

| From: Yoram Ramberg [mailto:[email-masked]]
|
| On the switch from SDN to RDN containment:
|
| This may be tricky. See if I got this one right.
| Once you impose strict containment on the DIT you're also presenting a
| restriction on relationships between rules and conditions relationships.
| What happens is that your forcing me to place all conditions related to a
| given rule under this rule in the DIT. What if another rule "wants" to use
| one of those conditions? It must copy that condition (if it knows how to
| find it) and place the copy unde the new rule. This makes that condition
| non-reusable. Two identical conditions must be maintained now and could be
| modified independently.

Yes and No (and now let me explain).  What the ABNF specifies
(and what is the correct way, I might add) is that
policyRuleConditionItem and policyRuleActionItem (two new
object classes) are restricted to be contained under the
policyRule object class.  For policyRuleConditionItem,
there are four attributes defined: policyRuleItemGroupNumber,
policyRuleItemNegated, policyRuleItemDN, and
policyRuleConditionItemName.  The last is a friendly name that
MAY be used as an RDN.  The other three are separate attributes
that replace the structures of the SDN as separate attributes.
Now, while a tuple (group number, negation, DN) [(group number, DN)
for policyRuleActionItem] is bound under a single policyRule in
the DIT, other policyRules may reuse the DN pointer to build
there own policy items.  While it is possible to restructure the
ABNF to allow for entire policyRuleConditionItem and policyRuleActionItem
reuse, I'm not yet convinced that this is a good thing.  Reusing
the DN's achieves 80-90% (my estimate) of full object class reuse
without cluttering up the schema with extra DN pointers.

| (I used conditions in my example because we deem conditions to be prime
| candidate for reusability. Everyone wishing to create a reusable object
| class and place it in the repository will have this problem exactly)
|
| Furthermore: SDN provide syntax for specifying the intra-expression
| relations, i.e., c1 AND c2 and NOT c3 or (NOT c4 abd C7). How would you
| express this if you drop SDNs altogether? We, then, must add
| syntax for this kind of expressions. RDN doesn't do the trick
| but atructured RDN still may still doesn't solve reusability).

The attribute policyRuleItemNegated handles the negation on an object by
object basis.

SDNs (or sRDNs) are a bad idea because they require the
client to process the returned string BEFORE they can determine if they
need to make another LDAP query to retrieve the pointed to object.  This
means that a client wanting to make only a single LDAP query would be
required to pull the ENTIRE policy tree [this is a BAD thing].
Also, by separating out the DN, you are setting up to take advantage of
a work that is going on in LDAPEXT.  If you use SDNs, you are limited
to "rolling your own".

Ryan