1 2 3 4 5 6 7 Network Working Group K. Zeilenga 8 Request for Comments: 4523 OpenLDAP Foundation 9 Obsoletes: 2252, 2256, 2587 June 2006 10 Category: Standards Track 11 12 13 Lightweight Directory Access Protocol (LDAP) 14 Schema Definitions for X.509 Certificates 15 16 Status of This Memo 17 18 This document specifies an Internet standards track protocol for the 19 Internet community, and requests discussion and suggestions for 20 improvements. Please refer to the current edition of the "Internet 21 Official Protocol Standards" (STD 1) for the standardization state 22 and status of this protocol. Distribution of this memo is unlimited. 23 24 Copyright Notice 25 26 Copyright (C) The Internet Society (2006). 27 28 Abstract 29 30 This document describes schema for representing X.509 certificates, 31 X.521 security information, and related elements in directories 32 accessible using the Lightweight Directory Access Protocol (LDAP). 33 The LDAP definitions for these X.509 and X.521 schema elements 34 replace those provided in RFCs 2252 and 2256. 35 36 1. Introduction 37 38 This document provides LDAP [RFC4510] schema definitions [RFC4512] 39 for a subset of elements specified in X.509 [X.509] and X.521 40 [X.521], including attribute types for certificates, cross 41 certificate pairs, and certificate revocation lists; matching rules 42 to be used with these attribute types; and related object classes. 43 LDAP syntax definitions are also provided for associated assertion 44 and attribute values. 45 46 As the semantics of these elements are as defined in X.509 and X.521, 47 knowledge of X.509 and X.521 is necessary to make use of the LDAP 48 schema definitions provided herein. 49 50 This document, together with [RFC4510], obsoletes RFCs 2252 and 2256 51 in their entirety. The changes (in this document) made since RFC 52 2252 and RFC 2256 include: 53 54 - addition of pkiUser, pkiCA, and deltaCRL classes; 55 56 57 58 Zeilenga Standards Track [Page 1] 59 61 RFC 4523 LDAP X.509 Schema June 2006 62 63 64 - update of attribute types to include equality matching rules in 65 accordance with their X.500 specifications; 66 67 - addition of certificate, certificate pair, certificate list, 68 and algorithm identifier matching rules; and 69 70 - addition of LDAP syntax for assertion syntaxes for these 71 matching rules. 72 73 This document obsoletes RFC 2587. The X.509 schema descriptions for 74 LDAPv2 [RFC1777] are Historic, as is LDAPv2 [RFC3494]. 75 76 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 77 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 78 document are to be interpreted as described in BCP 14 [RFC2119]. 79 80 Schema definitions are provided using LDAP description formats 81 [RFC4512]. Definitions provided here are formatted (line wrapped) 82 for readability. 83 84 2. Syntaxes 85 86 This section describes various syntaxes used in LDAP to transfer 87 certificates and related data types. 88 89 2.1. Certificate 90 91 ( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'X.509 Certificate' ) 92 93 A value of this syntax is an X.509 Certificate [X.509, clause 7]. 94 95 Due to changes made to the definition of a Certificate through time, 96 no LDAP-specific encoding is defined for this syntax. Values of this 97 syntax SHOULD be encoded using Distinguished Encoding Rules (DER) 98 [X.690] and MUST only be transferred using the ;binary transfer 99 option [RFC4522]; that is, by requesting and returning values using 100 attribute descriptions such as "userCertificate;binary". 101 102 As values of this syntax contain digitally signed data, values of 103 this syntax and the form of each value MUST be preserved as 104 presented. 105 106 2.2. CertificateList 107 108 ( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'X.509 Certificate List' ) 109 110 A value of this syntax is an X.509 CertificateList [X.509, clause 111 7.3]. 112 113 114 115 Zeilenga Standards Track [Page 2] 116 118 RFC 4523 LDAP X.509 Schema June 2006 119 120 121 Due to changes made to the definition of a CertificateList through 122 time, no LDAP-specific encoding is defined for this syntax. Values 123 of this syntax SHOULD be encoded using DER [X.690] and MUST only be 124 transferred using the ;binary transfer option [RFC4522]; that is, by 125 requesting and returning values using attribute descriptions such as 126 "certificateRevocationList;binary". 127 128 As values of this syntax contain digitally signed data, values of 129 this syntax and the form of each value MUST be preserved as 130 presented. 131 132 2.3. CertificatePair 133 134 ( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'X.509 Certificate Pair' ) 135 136 A value of this syntax is an X.509 CertificatePair [X.509, clause 137 11.2.3]. 138 139 Due to changes made to the definition of an X.509 CertificatePair 140 through time, no LDAP-specific encoding is defined for this syntax. 141 Values of this syntax SHOULD be encoded using DER [X.690] and MUST 142 only be transferred using the ;binary transfer option [RFC4522]; that 143 is, by requesting and returning values using attribute descriptions 144 such as "crossCertificatePair;binary". 145 146 As values of this syntax contain digitally signed data, values of 147 this syntax and the form of each value MUST be preserved as 148 presented. 149 150 2.4. SupportedAlgorithm 151 152 ( 1.3.6.1.4.1.1466.115.121.1.49 153 DESC 'X.509 Supported Algorithm' ) 154 155 A value of this syntax is an X.509 SupportedAlgorithm [X.509, clause 156 11.2.7]. 157 158 Due to changes made to the definition of an X.509 SupportedAlgorithm 159 through time, no LDAP-specific encoding is defined for this syntax. 160 Values of this syntax SHOULD be encoded using DER [X.690] and MUST 161 only be transferred using the ;binary transfer option [RFC4522]; that 162 is, by requesting and returning values using attribute descriptions 163 such as "supportedAlgorithms;binary". 164 165 As values of this syntax contain digitally signed data, values of 166 this syntax and the form of the value MUST be preserved as presented. 167 168 169 170 171 172 Zeilenga Standards Track [Page 3] 173 175 RFC 4523 LDAP X.509 Schema June 2006 176 177 178 2.5. CertificateExactAssertion 179 180 ( 1.3.6.1.1.15.1 DESC 'X.509 Certificate Exact Assertion' ) 181 182 A value of this syntax is an X.509 CertificateExactAssertion [X.509, 183 clause 11.3.1]. Values of this syntax MUST be encoded using the 184 Generic String Encoding Rules (GSER) [RFC3641]. Appendix A.1 185 provides an equivalent Augmented Backus-Naur Form (ABNF) [RFC4234] 186 grammar for this syntax. 187 188 2.6. CertificateAssertion 189 190 ( 1.3.6.1.1.15.2 DESC 'X.509 Certificate Assertion' ) 191 192 A value of this syntax is an X.509 CertificateAssertion [X.509, 193 clause 11.3.2]. Values of this syntax MUST be encoded using GSER 194 [RFC3641]. Appendix A.2 provides an equivalent ABNF [RFC4234] 195 grammar for this syntax. 196 197 2.7. CertificatePairExactAssertion 198 199 ( 1.3.6.1.1.15.3 200 DESC 'X.509 Certificate Pair Exact Assertion' ) 201 202 A value of this syntax is an X.509 CertificatePairExactAssertion 203 [X.509, clause 11.3.3]. Values of this syntax MUST be encoded using 204 GSER [RFC3641]. Appendix A.3 provides an equivalent ABNF [RFC4234] 205 grammar for this syntax. 206 207 2.8. CertificatePairAssertion 208 209 ( 1.3.6.1.1.15.4 DESC 'X.509 Certificate Pair Assertion' ) 210 211 A value of this syntax is an X.509 CertificatePairAssertion [X.509, 212 clause 11.3.4]. Values of this syntax MUST be encoded using GSER 213 [RFC3641]. Appendix A.4 provides an equivalent ABNF [RFC4234] 214 grammar for this syntax. 215 216 2.9. CertificateListExactAssertion 217 218 ( 1.3.6.1.1.15.5 219 DESC 'X.509 Certificate List Exact Assertion' ) 220 221 A value of this syntax is an X.509 CertificateListExactAssertion 222 [X.509, clause 11.3.5]. Values of this syntax MUST be encoded using 223 GSER [RFC3641]. Appendix A.5 provides an equivalent ABNF grammar for 224 this syntax. 225 226 227 228 229 Zeilenga Standards Track [Page 4] 230 232 RFC 4523 LDAP X.509 Schema June 2006 233 234 235 2.10. CertificateListAssertion 236 237 ( 1.3.6.1.1.15.6 DESC 'X.509 Certificate List Assertion' ) 238 239 A value of this syntax is an X.509 CertificateListAssertion [X.509, 240 clause 11.3.6]. Values of this syntax MUST be encoded using GSER 241 [RFC3641]. Appendix A.6 provides an equivalent ABNF [RFC4234] 242 grammar for this syntax. 243 244 2.11. AlgorithmIdentifier 245 246 ( 1.3.6.1.1.15.7 DESC 'X.509 Algorithm Identifier' ) 247 248 A value of this syntax is an X.509 AlgorithmIdentifier [X.509, Clause 249 7]. Values of this syntax MUST be encoded using GSER [RFC3641]. 250 251 Appendix A.7 provides an equivalent ABNF [RFC4234] grammar for this 252 syntax. 253 254 3. Matching Rules 255 256 This section introduces a set of certificate and related matching 257 rules for use in LDAP. These rules are intended to act in accordance 258 with their X.500 counterparts. 259 260 3.1. certificateExactMatch 261 262 The certificateExactMatch matching rule compares the presented 263 certificate exact assertion value with an attribute value of the 264 certificate syntax as described in clause 11.3.1 of [X.509]. 265 266 ( 2.5.13.34 NAME 'certificateExactMatch' 267 DESC 'X.509 Certificate Exact Match' 268 SYNTAX 1.3.6.1.1.15.1 ) 269 270 3.2. certificateMatch 271 272 The certificateMatch matching rule compares the presented certificate 273 assertion value with an attribute value of the certificate syntax as 274 described in clause 11.3.2 of [X.509]. 275 276 ( 2.5.13.35 NAME 'certificateMatch' 277 DESC 'X.509 Certificate Match' 278 SYNTAX 1.3.6.1.1.15.2 ) 279 280 281 282 283 284 285 286 Zeilenga Standards Track [Page 5] 287 289 RFC 4523 LDAP X.509 Schema June 2006 290 291 292 3.3. certificatePairExactMatch 293 294 The certificatePairExactMatch matching rule compares the presented 295 certificate pair exact assertion value with an attribute value of the 296 certificate pair syntax as described in clause 11.3.3 of [X.509]. 297 298 ( 2.5.13.36 NAME 'certificatePairExactMatch' 299 DESC 'X.509 Certificate Pair Exact Match' 300 SYNTAX 1.3.6.1.1.15.3 ) 301 302 3.4. certificatePairMatch 303 304 The certificatePairMatch matching rule compares the presented 305 certificate pair assertion value with an attribute value of the 306 certificate pair syntax as described in clause 11.3.4 of [X.509]. 307 308 ( 2.5.13.37 NAME 'certificatePairMatch' 309 DESC 'X.509 Certificate Pair Match' 310 SYNTAX 1.3.6.1.1.15.4 ) 311 312 3.5. certificateListExactMatch 313 314 The certificateListExactMatch matching rule compares the presented 315 certificate list exact assertion value with an attribute value of the 316 certificate pair syntax as described in clause 11.3.5 of [X.509]. 317 318 ( 2.5.13.38 NAME 'certificateListExactMatch' 319 DESC 'X.509 Certificate List Exact Match' 320 SYNTAX 1.3.6.1.1.15.5 ) 321 322 3.6. certificateListMatch 323 324 The certificateListMatch matching rule compares the presented 325 certificate list assertion value with an attribute value of the 326 certificate pair syntax as described in clause 11.3.6 of [X.509]. 327 328 ( 2.5.13.39 NAME 'certificateListMatch' 329 DESC 'X.509 Certificate List Match' 330 SYNTAX 1.3.6.1.1.15.6 ) 331 332 333 334 335 336 337 338 339 340 341 342 343 Zeilenga Standards Track [Page 6] 344 346 RFC 4523 LDAP X.509 Schema June 2006 347 348 349 3.7. algorithmIdentifierMatch 350 351 The algorithmIdentifierMatch mating rule compares a presented 352 algorithm identifier with an attribute value of the supported 353 algorithm as described in clause 11.3.7 of [X.509]. 354 355 ( 2.5.13.40 NAME 'algorithmIdentifier' 356 DESC 'X.509 Algorithm Identifier Match' 357 SYNTAX 1.3.6.1.1.15.7 ) 358 359 4. Attribute Types 360 361 This section details a set of certificate and related attribute types 362 for use in LDAP. 363 364 4.1. userCertificate 365 366 The userCertificate attribute holds the X.509 certificates issued to 367 the user by one or more certificate authorities, as discussed in 368 clause 11.2.1 of [X.509]. 369 370 ( 2.5.4.36 NAME 'userCertificate' 371 DESC 'X.509 user certificate' 372 EQUALITY certificateExactMatch 373 SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 ) 374 375 As required by this attribute type's syntax, values of this attribute 376 are requested and transferred using the attribute description 377 "userCertificate;binary". 378 379 4.2. cACertificate 380 381 The cACertificate attribute holds the X.509 certificates issued to 382 the certificate authority (CA), as discussed in clause 11.2.2 of 383 [X.509]. 384 385 ( 2.5.4.37 NAME 'cACertificate' 386 DESC 'X.509 CA certificate' 387 EQUALITY certificateExactMatch 388 SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 ) 389 390 As required by this attribute type's syntax, values of this attribute 391 are requested and transferred using the attribute description 392 "cACertificate;binary". 393 394 395 396 397 398 399 400 Zeilenga Standards Track [Page 7] 401 403 RFC 4523 LDAP X.509 Schema June 2006 404 405 406 4.3. crossCertificatePair 407 408 The crossCertificatePair attribute holds an X.509 certificate pair, 409 as discussed in clause 11.2.3 of [X.509]. 410 411 ( 2.5.4.40 NAME 'crossCertificatePair' 412 DESC 'X.509 cross certificate pair' 413 EQUALITY certificatePairExactMatch 414 SYNTAX 1.3.6.1.4.1.1466.115.121.1.10 ) 415 416 As required by this attribute type's syntax, values of this attribute 417 are requested and transferred using the attribute description 418 "crossCertificatePair;binary". 419 420 4.4. certificateRevocationList 421 422 The certificateRevocationList attribute holds certificate lists, as 423 discussed in 11.2.4 of [X.509]. 424 425 ( 2.5.4.39 NAME 'certificateRevocationList' 426 DESC 'X.509 certificate revocation list' 427 EQUALITY certificateListExactMatch 428 SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 ) 429 430 As required by this attribute type's syntax, values of this attribute 431 are requested and transferred using the attribute description 432 "certificateRevocationList;binary". 433 434 4.5. authorityRevocationList 435 436 The authorityRevocationList attribute holds certificate lists, as 437 discussed in 11.2.5 of [X.509]. 438 439 ( 2.5.4.38 NAME 'authorityRevocationList' 440 DESC 'X.509 authority revocation list' 441 EQUALITY certificateListExactMatch 442 SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 ) 443 444 As required by this attribute type's syntax, values of this attribute 445 are requested and transferred using the attribute description 446 "authorityRevocationList;binary". 447 448 449 450 451 452 453 454 455 456 457 Zeilenga Standards Track [Page 8] 458 460 RFC 4523 LDAP X.509 Schema June 2006 461 462 463 4.6. deltaRevocationList 464 465 The deltaRevocationList attribute holds certificate lists, as 466 discussed in 11.2.6 of [X.509]. 467 468 ( 2.5.4.53 NAME 'deltaRevocationList' 469 DESC 'X.509 delta revocation list' 470 EQUALITY certificateListExactMatch 471 SYNTAX 1.3.6.1.4.1.1466.115.121.1.9 ) 472 473 As required by this attribute type's syntax, values of this attribute 474 MUST be requested and transferred using the attribute description 475 "deltaRevocationList;binary". 476 477 4.7. supportedAlgorithms 478 479 The supportedAlgorithms attribute holds supported algorithms, as 480 discussed in 11.2.7 of [X.509]. 481 482 ( 2.5.4.52 NAME 'supportedAlgorithms' 483 DESC 'X.509 supported algorithms' 484 EQUALITY algorithmIdentifierMatch 485 SYNTAX 1.3.6.1.4.1.1466.115.121.1.49 ) 486 487 As required by this attribute type's syntax, values of this attribute 488 MUST be requested and transferred using the attribute description 489 "supportedAlgorithms;binary". 490 491 5. Object Classes 492 493 This section details a set of certificate-related object classes for 494 use in LDAP. 495 496 5.1. pkiUser 497 498 This object class is used in augment entries for objects that may be 499 subject to certificates, as defined in clause 11.1.1 of [X.509]. 500 501 ( 2.5.6.21 NAME 'pkiUser' 502 DESC 'X.509 PKI User' 503 SUP top AUXILIARY 504 MAY userCertificate ) 505 506 507 508 509 510 511 512 513 514 Zeilenga Standards Track [Page 9] 515 517 RFC 4523 LDAP X.509 Schema June 2006 518 519 520 5.2. pkiCA 521 522 This object class is used to augment entries for objects that act as 523 certificate authorities, as defined in clause 11.1.2 of [X.509] 524 525 ( 2.5.6.22 NAME 'pkiCA' 526 DESC 'X.509 PKI Certificate Authority' 527 SUP top AUXILIARY 528 MAY ( cACertificate $ certificateRevocationList $ 529 authorityRevocationList $ crossCertificatePair ) ) 530 531 5.3. cRLDistributionPoint 532 533 This class is used to represent objects that act as CRL distribution 534 points, as discussed in clause 11.1.3 of [X.509]. 535 536 ( 2.5.6.19 NAME 'cRLDistributionPoint' 537 DESC 'X.509 CRL distribution point' 538 SUP top STRUCTURAL 539 MUST cn 540 MAY ( certificateRevocationList $ 541 authorityRevocationList $ deltaRevocationList ) ) 542 543 5.4. deltaCRL 544 545 The deltaCRL object class is used to augment entries to hold delta 546 revocation lists, as discussed in clause 11.1.4 of [X.509]. 547 548 ( 2.5.6.23 NAME 'deltaCRL' 549 DESC 'X.509 delta CRL' 550 SUP top AUXILIARY 551 MAY deltaRevocationList ) 552 553 5.5. strongAuthenticationUser 554 555 This object class is used to augment entries for objects 556 participating in certificate-based authentication, as defined in 557 clause 6.15 of [X.521]. This object class is deprecated in favor of 558 pkiUser. 559 560 ( 2.5.6.15 NAME 'strongAuthenticationUser' 561 DESC 'X.521 strong authentication user' 562 SUP top AUXILIARY 563 MUST userCertificate ) 564 565 566 567 568 569 570 571 Zeilenga Standards Track [Page 10] 572 574 RFC 4523 LDAP X.509 Schema June 2006 575 576 577 5.6. userSecurityInformation 578 579 This object class is used to augment entries with needed additional 580 associated security information, as defined in clause 6.16 of 581 [X.521]. 582 583 ( 2.5.6.18 NAME 'userSecurityInformation' 584 DESC 'X.521 user security information' 585 SUP top AUXILIARY 586 MAY ( supportedAlgorithms ) ) 587 588 5.7. certificationAuthority 589 590 This object class is used to augment entries for objects that act as 591 certificate authorities, as defined in clause 6.17 of [X.521]. This 592 object class is deprecated in favor of pkiCA. 593 594 ( 2.5.6.16 NAME 'certificationAuthority' 595 DESC 'X.509 certificate authority' 596 SUP top AUXILIARY 597 MUST ( authorityRevocationList $ 598 certificateRevocationList $ cACertificate ) 599 MAY crossCertificatePair ) 600 601 5.8. certificationAuthority-V2 602 603 This object class is used to augment entries for objects that act as 604 certificate authorities, as defined in clause 6.18 of [X.521]. This 605 object class is deprecated in favor of pkiCA. 606 607 ( 2.5.6.16.2 NAME 'certificationAuthority-V2' 608 DESC 'X.509 certificate authority, version 2' 609 SUP certificationAuthority AUXILIARY 610 MAY deltaRevocationList ) 611 612 6. Security Considerations 613 614 General certificate considerations [RFC3280] apply to LDAP-aware 615 certificate applications. General LDAP security considerations 616 [RFC4510] apply as well. 617 618 While elements of certificate information are commonly signed, these 619 signatures only protect the integrity of the signed information. In 620 the absence of data integrity protections in LDAP (or lower layer, 621 e.g., IPsec), a server is not assured that client certificate request 622 (or other request) was unaltered in transit. Likewise, a client 623 cannot be assured that the results of the query were unaltered in 624 625 626 627 628 Zeilenga Standards Track [Page 11] 629 631 RFC 4523 LDAP X.509 Schema June 2006 632 633 634 transit. Hence, it is generally recommended that implementations 635 make use of authentication and data integrity services in LDAP 636 [RFC4513][RFC4511]. 637 638 7. IANA Considerations 639 640 7.1. Object Identifier Registration 641 642 The IANA has registered an LDAP Object Identifier [RFC4520] for use 643 in this technical specification. 644 645 Subject: Request for LDAP OID Registration 646 Person & email address to contact for further information: 647 Kurt Zeilenga <kurt (a] OpenLDAP.org> 648 Specification: RFC 4523 649 Author/Change Controller: IESG 650 Comments: 651 Identifies the LDAP X.509 Certificate schema elements 652 introduced in this document. 653 654 7.2. Descriptor Registration 655 656 The IANA has updated the LDAP 657 Descriptor registry [RFC44520] as indicated below. 658 659 Subject: Request for LDAP Descriptor Registration 660 Descriptor (short name): see table 661 Object Identifier: see table 662 Person & email address to contact for further information: 663 Kurt Zeilenga <kurt (a] OpenLDAP.org> 664 Usage: see table 665 Specification: RFC 4523 666 Author/Change Controller: IESG 667 668 algorithmIdentifierMatch M 2.5.13.40 669 authorityRevocationList A 2.5.4.38 * 670 cACertificate A 2.5.4.37 * 671 cRLDistributionPoint O 2.5.6.19 * 672 certificateExactMatch M 2.5.13.34 673 certificateListExactMatch M 2.5.13.38 674 certificateListMatch M 2.5.13.39 675 certificateMatch M 2.5.13.35 676 certificatePairExactMatch M 2.5.13.36 677 certificatePairMatch M 2.5.13.37 678 certificateRevocationList A 2.5.4.39 * 679 certificationAuthority O 2.5.6.16 * 680 certificationAuthority-V2 O 2.5.6.16.2 * 681 crossCertificatePair A 2.5.4.40 * 682 683 684 685 Zeilenga Standards Track [Page 12] 686 688 RFC 4523 LDAP X.509 Schema June 2006 689 690 691 deltaCRL O 2.5.6.23 * 692 deltaRevocationList A 2.5.4.53 * 693 pkiCA O 2.5.6.22 * 694 pkiUser O 2.5.6.21 * 695 strongAuthenticationUser O 2.5.6.15 * 696 supportedAlgorithms A 2.5.4.52 * 697 userCertificate A 2.5.4.36 * 698 userSecurityInformation O 2.5.6.18 * 699 700 * Updates previous registration 701 702 8. Acknowledgements 703 704 This document is based on X.509, a product of the ITU-T. A number of 705 LDAP schema definitions were based on those found in RFCs 2252 and 706 2256, both products of the IETF ASID WG. The ABNF productions in 707 Appendix A were provided by Steven Legg. Additional material was 708 borrowed from prior works by David Chadwick and Steven Legg to refine 709 the LDAP X.509 schema. 710 711 9. References 712 713 9.1. Normative References 714 715 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 716 Requirement Levels", BCP 14, RFC 2119, March 1997. 717 718 [RFC3641] Legg, S., "Generic String Encoding Rules (GSER) for ASN.1 719 Types", RFC 3641, October 2003. 720 721 [RFC4510] Zeilenga, K., Ed., "Lightweight Directory Access Protocol 722 (LDAP): Technical Specification Road Map", RFC 4510, June 723 2006. 724 725 [RFC4512] Zeilenga, K., "Lightweight Directory Access Protocol 726 (LDAP): Directory Information Models", RFC 4512, June 727 2006. 728 729 [RFC4522] Legg, S., "Lightweight Directory Access Protocol (LDAP): 730 The Binary Encoding Option", RFC 4522, June 2006. 731 732 [X.509] International Telecommunication Union - Telecommunication 733 Standardization Sector, "The Directory: Authentication 734 Framework", X.509(2000). 735 736 737 738 739 740 741 742 Zeilenga Standards Track [Page 13] 743 745 RFC 4523 LDAP X.509 Schema June 2006 746 747 748 [X.521] International Telecommunication Union - Telecommunication 749 Standardization Sector, "The Directory: Selected Object 750 Classes", X.521(2000). 751 752 [X.690] International Telecommunication Union - Telecommunication 753 Standardization Sector, "Specification of ASN.1 encoding 754 rules: Basic Encoding Rules (BER), Canonical Encoding 755 Rules (CER), and Distinguished Encoding Rules (DER)", 756 X.690(2002) (also ISO/IEC 8825-1:2002). 757 758 9.2. Informative References 759 760 [RFC1777] Yeong, W., Howes, T., and S. Kille, "Lightweight Directory 761 Access Protocol", RFC 1777, March 1995. 762 763 [RFC2156] Kille, S., "MIXER (Mime Internet X.400 Enhanced Relay): 764 Mapping between X.400 and RFC 822/MIME", RFC 2156, January 765 1998. 766 767 [RFC3280] Housley, R., Polk, W., Ford, W., and D. Solo, "Internet 768 X.509 Public Key Infrastructure Certificate and 769 Certificate Revocation List (CRL) Profile", RFC 3280, 770 April 2002. 771 772 [RFC3494] Zeilenga, K., "Lightweight Directory Access Protocol 773 version 2 (LDAPv2) to Historic Status", RFC 3494, March 774 2003. 775 776 [RFC3642] Legg, S., "Common Elements of Generic String Encoding 777 Rules (GSER) Encodings", RFC 3642, October 2003. 778 779 [RFC4234] Crocker, D. and P. Overell, "Augmented BNF for Syntax 780 Specifications: ABNF", RFC 4234, October 2005. 781 782 [RFC4511] Sermersheim, J., Ed., "Lightweight Directory Access 783 Protocol (LDAP): The Protocol", RFC 4511, June 2006. 784 785 [RFC4513] Harrison, R. Ed., "Lightweight Directory Access Protocol 786 (LDAP): Authentication Methods and Security Mechanisms", 787 RFC 4513, June 2006. 788 789 [RFC4520] Zeilenga, K., "Internet Assigned Numbers Authority (IANA) 790 Considerations for the Lightweight Directory Access 791 Protocol (LDAP)", BCP 64, RFC 4520, June 2006. 792 793 794 795 796 797 798 799 Zeilenga Standards Track [Page 14] 800 802 RFC 4523 LDAP X.509 Schema June 2006 803 804 805 Appendix A. 806 807 This appendix is informative. 808 809 This appendix provides ABNF [RFC4234] grammars for GSER-based 810 [RFC3641] LDAP-specific encodings specified in this document. These 811 grammars where produced using, and relying on, Common Elements for 812 GSER Encodings [RFC3642]. 813 814 A.1. CertificateExactAssertion 815 816 CertificateExactAssertion = "{" sp cea-serialNumber "," 817 sp cea-issuer sp "}" 818 819 cea-serialNumber = id-serialNumber msp CertificateSerialNumber 820 cea-issuer = id-issuer msp Name 821 822 id-serialNumber = 823 %x73.65.72.69.61.6C.4E.75.6D.62.65.72 ; 'serialNumber' 824 id-issuer = %x69.73.73.75.65.72 ; 'issuer' 825 826 Name = id-rdnSequence ":" RDNSequence 827 id-rdnSequence = %x72.64.6E.53.65.71.75.65.6E.63.65 ; 'rdnSequence' 828 829 CertificateSerialNumber = INTEGER 830 831 A.2. CertificateAssertion 832 833 CertificateAssertion = "{" [ sp ca-serialNumber ] 834 [ sep sp ca-issuer ] 835 [ sep sp ca-subjectKeyIdentifier ] 836 [ sep sp ca-authorityKeyIdentifier ] 837 [ sep sp ca-certificateValid ] 838 [ sep sp ca-privateKeyValid ] 839 [ sep sp ca-subjectPublicKeyAlgID ] 840 [ sep sp ca-keyUsage ] 841 [ sep sp ca-subjectAltName ] 842 [ sep sp ca-policy ] 843 [ sep sp ca-pathToName ] 844 [ sep sp ca-subject ] 845 [ sep sp ca-nameConstraints ] sp "}" 846 847 ca-serialNumber = id-serialNumber msp CertificateSerialNumber 848 ca-issuer = id-issuer msp Name 849 ca-subjectKeyIdentifier = id-subjectKeyIdentifier msp 850 SubjectKeyIdentifier 851 ca-authorityKeyIdentifier = id-authorityKeyIdentifier msp 852 AuthorityKeyIdentifier 853 854 855 856 Zeilenga Standards Track [Page 15] 857 859 RFC 4523 LDAP X.509 Schema June 2006 860 861 862 ca-certificateValid = id-certificateValid msp Time 863 ca-privateKeyValid = id-privateKeyValid msp GeneralizedTime 864 ca-subjectPublicKeyAlgID = id-subjectPublicKeyAlgID msp 865 OBJECT-IDENTIFIER 866 ca-keyUsage = id-keyUsage msp KeyUsage 867 ca-subjectAltName = id-subjectAltName msp AltNameType 868 ca-policy = id-policy msp CertPolicySet 869 ca-pathToName = id-pathToName msp Name 870 ca-subject = id-subject msp Name 871 ca-nameConstraints = id-nameConstraints msp NameConstraintsSyntax 872 873 id-subjectKeyIdentifier = 874 %x73.75.62.6A.65.63.74.4B.65.79.49.64.65.6E.74.69.66.69.65.72 875 ; 'subjectKeyIdentifier' 876 id-authorityKeyIdentifier = 877 %x61.75.74.68.6F.72.69.74.79.4B.65.79.49.64.65.6E.74.69.66.69.65.72 878 ; 'authorityKeyIdentifier' 879 id-certificateValid = %x63.65.72.74.69.66.69.63.61.74.65.56.61.6C.69.64 880 ; 'certificateValid' 881 id-privateKeyValid = %x70.72.69.76.61.74.65.4B.65.79.56.61.6C.69.64 882 ; 'privateKeyValid' 883 id-subjectPublicKeyAlgID = 884 %x73.75.62.6A.65.63.74.50.75.62.6C.69.63.4B.65.79.41.6C.67.49.44 885 ; 'subjectPublicKeyAlgID' 886 id-keyUsage = %x6B.65.79.55.73.61.67.65 ; 'keyUsage' 887 id-subjectAltName = %x73.75.62.6A.65.63.74.41.6C.74.4E.61.6D.65 888 ; 'subjectAltName' 889 id-policy = %x70.6F.6C.69.63.79 ; 'policy' 890 id-pathToName = %x70.61.74.68.54.6F.4E.61.6D.65 ; 'pathToName' 891 id-subject = %x73.75.62.6A.65.63.74 ; 'subject' 892 id-nameConstraints = %x6E.61.6D.65.43.6F.6E.73.74.72.61.69.6E.74.73 893 ; 'nameConstraints' 894 895 SubjectKeyIdentifier = KeyIdentifier 896 897 KeyIdentifier = OCTET-STRING 898 899 AuthorityKeyIdentifier = "{" [ sp aki-keyIdentifier ] 900 [ sep sp aki-authorityCertIssuer ] 901 [ sep sp aki-authorityCertSerialNumber ] sp "}" 902 903 aki-keyIdentifier = id-keyIdentifier msp KeyIdentifier 904 aki-authorityCertIssuer = id-authorityCertIssuer msp GeneralNames 905 906 GeneralNames = "{" sp GeneralName *( "," sp GeneralName ) sp "}" 907 GeneralName = gn-otherName 908 / gn-rfc822Name 909 / gn-dNSName 910 911 912 913 Zeilenga Standards Track [Page 16] 914 916 RFC 4523 LDAP X.509 Schema June 2006 917 918 919 / gn-x400Address 920 / gn-directoryName 921 / gn-ediPartyName 922 / gn-uniformResourceIdentifier 923 / gn-iPAddress 924 / gn-registeredID 925 926 gn-otherName = id-otherName ":" OtherName 927 gn-rfc822Name = id-rfc822Name ":" IA5String 928 gn-dNSName = id-dNSName ":" IA5String 929 gn-x400Address = id-x400Address ":" ORAddress 930 gn-directoryName = id-directoryName ":" Name 931 gn-ediPartyName = id-ediPartyName ":" EDIPartyName 932 gn-iPAddress = id-iPAddress ":" OCTET-STRING 933 gn-registeredID = gn-id-registeredID ":" OBJECT-IDENTIFIER 934 935 gn-uniformResourceIdentifier = id-uniformResourceIdentifier 936 ":" IA5String 937 938 id-otherName = %x6F.74.68.65.72.4E.61.6D.65 ; 'otherName' 939 gn-id-registeredID = %x72.65.67.69.73.74.65.72.65.64.49.44 940 ; 'registeredID' 941 942 OtherName = "{" sp on-type-id "," sp on-value sp "}" 943 on-type-id = id-type-id msp OBJECT-IDENTIFIER 944 on-value = id-value msp Value 945 ;; <Value> as defined in Section 3 of [RFC3641] 946 947 id-type-id = %x74.79.70.65.2D.69.64 ; 'type-id' 948 id-value = %x76.61.6C.75.65 ; 'value' 949 950 ORAddress = dquote *SafeIA5Character dquote 951 SafeIA5Character = %x01-21 / %x23-7F / ; ASCII minus dquote 952 dquote dquote ; escaped double quote 953 dquote = %x22 ; '"' (double quote) 954 955 ;; Note: The <ORAddress> rule encodes the x400Address component 956 ;; of a GeneralName as a character string between double quotes. 957 ;; The character string is first derived according to Section 4.1 958 ;; of [RFC2156], and then any embedded double quotes are escaped 959 ;; by being repeated. This resulting string is output between 960 ;; double quotes. 961 962 EDIPartyName = "{" [ sp nameAssigner "," ] sp partyName sp "}" 963 nameAssigner = id-nameAssigner msp DirectoryString 964 partyName = id-partyName msp DirectoryString 965 id-nameAssigner = %x6E.61.6D.65.41.73.73.69.67.6E.65.72 966 ; 'nameAssigner' 967 968 969 970 Zeilenga Standards Track [Page 17] 971 973 RFC 4523 LDAP X.509 Schema June 2006 974 975 976 id-partyName = %x70.61.72.74.79.4E.61.6D.65 ; 'partyName' 977 978 aki-authorityCertSerialNumber = id-authorityCertSerialNumber 979 msp CertificateSerialNumber 980 981 id-keyIdentifier = %x6B.65.79.49.64.65.6E.74.69.66.69.65.72 982 ; 'keyIdentifier' 983 id-authorityCertIssuer = 984 %x61.75.74.68.6F.72.69.74.79.43.65.72.74.49.73.73.75.65.72 985 ; 'authorityCertIssuer' 986 987 id-authorityCertSerialNumber = %x61.75.74.68.6F.72.69.74.79.43 988 %x65.72.74.53.65.72.69.61.6C.4E.75.6D.62.65.72 989 ; 'authorityCertSerialNumber' 990 991 Time = time-utcTime / time-generalizedTime 992 time-utcTime = id-utcTime ":" UTCTime 993 time-generalizedTime = id-generalizedTime ":" GeneralizedTime 994 id-utcTime = %x75.74.63.54.69.6D.65 ; 'utcTime' 995 id-generalizedTime = %x67.65.6E.65.72.61.6C.69.7A.65.64.54.69.6D.65 996 ; 'generalizedTime' 997 998 KeyUsage = BIT-STRING / key-usage-bit-list 999 key-usage-bit-list = "{" [ sp key-usage *( "," sp key-usage ) ] sp "}" 1000 1001 ;; Note: The <key-usage-bit-list> rule encodes the one bits in 1002 ;; a KeyUsage value as a comma separated list of identifiers. 1003 1004 key-usage = id-digitalSignature 1005 / id-nonRepudiation 1006 / id-keyEncipherment 1007 / id-dataEncipherment 1008 / id-keyAgreement 1009 / id-keyCertSign 1010 / id-cRLSign 1011 / id-encipherOnly 1012 / id-decipherOnly 1013 1014 id-digitalSignature = %x64.69.67.69.74.61.6C.53.69.67.6E.61.74 1015 %x75.72.65 ; 'digitalSignature' 1016 id-nonRepudiation = %x6E.6F.6E.52.65.70.75.64.69.61.74.69.6F.6E 1017 ; 'nonRepudiation' 1018 id-keyEncipherment = %x6B.65.79.45.6E.63.69.70.68.65.72.6D.65.6E.74 1019 ; 'keyEncipherment' 1020 id-dataEncipherment = %x64.61.74.61.45.6E.63.69.70.68.65.72.6D.65.6E 1021 %x74 ; "dataEncipherment' 1022 id-keyAgreement = %x6B.65.79.41.67.72.65.65.6D.65.6E.74 1023 ; 'keyAgreement' 1024 1025 1026 1027 Zeilenga Standards Track [Page 18] 1028 1030 RFC 4523 LDAP X.509 Schema June 2006 1031 1032 1033 id-keyCertSign = %x6B.65.79.43.65.72.74.53.69.67.6E 1034 ; 'keyCertSign' 1035 id-cRLSign = %x63.52.4C.53.69.67.6E ; "cRLSign" 1036 id-encipherOnly = %x65.6E.63.69.70.68.65.72.4F.6E.6C.79 1037 ; 'encipherOnly' 1038 id-decipherOnly = %x64.65.63.69.70.68.65.72.4F.6E.6C.79 1039 ; 'decipherOnly' 1040 1041 AltNameType = ant-builtinNameForm / ant-otherNameForm 1042 1043 ant-builtinNameForm = id-builtinNameForm ":" BuiltinNameForm 1044 ant-otherNameForm = id-otherNameForm ":" OBJECT-IDENTIFIER 1045 1046 id-builtinNameForm = %x62.75.69.6C.74.69.6E.4E.61.6D.65.46.6F.72.6D 1047 ; 'builtinNameForm' 1048 id-otherNameForm = %x6F.74.68.65.72.4E.61.6D.65.46.6F.72.6D 1049 ; 'otherNameForm' 1050 1051 BuiltinNameForm = id-rfc822Name 1052 / id-dNSName 1053 / id-x400Address 1054 / id-directoryName 1055 / id-ediPartyName 1056 / id-uniformResourceIdentifier 1057 / id-iPAddress 1058 / id-registeredId 1059 1060 id-rfc822Name = %x72.66.63.38.32.32.4E.61.6D.65 ; 'rfc822Name' 1061 id-dNSName = %x64.4E.53.4E.61.6D.65 ; 'dNSName' 1062 id-x400Address = %x78.34.30.30.41.64.64.72.65.73.73 ; 'x400Address' 1063 id-directoryName = %x64.69.72.65.63.74.6F.72.79.4E.61.6D.65 1064 ; 'directoryName' 1065 id-ediPartyName = %x65.64.69.50.61.72.74.79.4E.61.6D.65 1066 ; 'ediPartyName' 1067 id-iPAddress = %x69.50.41.64.64.72.65.73.73 ; 'iPAddress' 1068 id-registeredId = %x72.65.67.69.73.74.65.72.65.64.49.64 1069 ; 'registeredId' 1070 1071 id-uniformResourceIdentifier = %x75.6E.69.66.6F.72.6D.52.65.73.6F.75 1072 %x72.63.65.49.64.65.6E.74.69.66.69.65.72 1073 ; 'uniformResourceIdentifier' 1074 1075 CertPolicySet = "{" sp CertPolicyId *( "," sp CertPolicyId ) sp "}" 1076 CertPolicyId = OBJECT-IDENTIFIER 1077 1078 NameConstraintsSyntax = "{" [ sp ncs-permittedSubtrees ] 1079 [ sep sp ncs-excludedSubtrees ] sp "}" 1080 1081 1082 1083 1084 Zeilenga Standards Track [Page 19] 1085 1087 RFC 4523 LDAP X.509 Schema June 2006 1088 1089 1090 ncs-permittedSubtrees = id-permittedSubtrees msp GeneralSubtrees 1091 ncs-excludedSubtrees = id-excludedSubtrees msp GeneralSubtrees 1092 1093 id-permittedSubtrees = 1094 %x70.65.72.6D.69.74.74.65.64.53.75.62.74.72.65.65.73 1095 ; 'permittedSubtrees' 1096 id-excludedSubtrees = 1097 %x65.78.63.6C.75.64.65.64.53.75.62.74.72.65.65.73 1098 ; 'excludedSubtrees' 1099 1100 GeneralSubtrees = "{" sp GeneralSubtree 1101 *( "," sp GeneralSubtree ) sp "}" 1102 GeneralSubtree = "{" sp gs-base 1103 [ "," sp gs-minimum ] 1104 [ "," sp gs-maximum ] sp "}" 1105 1106 gs-base = id-base msp GeneralName 1107 gs-minimum = id-minimum msp BaseDistance 1108 gs-maximum = id-maximum msp BaseDistance 1109 1110 id-base = %x62.61.73.65 ; 'base' 1111 id-minimum = %x6D.69.6E.69.6D.75.6D ; 'minimum' 1112 id-maximum = %x6D.61.78.69.6D.75.6D ; 'maximum' 1113 1114 BaseDistance = INTEGER-0-MAX 1115 1116 A.3. CertificatePairExactAssertion 1117 1118 CertificatePairExactAssertion = "{" [ sp cpea-issuedTo ] 1119 [sep sp cpea-issuedBy ] sp "}" 1120 ;; At least one of <cpea-issuedTo> or <cpea-issuedBy> MUST be present. 1121 1122 cpea-issuedTo = id-issuedToThisCAAssertion msp 1123 CertificateExactAssertion 1124 cpea-issuedBy = id-issuedByThisCAAssertion msp 1125 CertificateExactAssertion 1126 1127 id-issuedToThisCAAssertion = %x69.73.73.75.65.64.54.6F.54.68.69.73 1128 %x43.41.41.73.73.65.72.74.69.6F.6E ; 'issuedToThisCAAssertion' 1129 id-issuedByThisCAAssertion = %x69.73.73.75.65.64.42.79.54.68.69.73 1130 %x43.41.41.73.73.65.72.74.69.6F.6E ; 'issuedByThisCAAssertion' 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 Zeilenga Standards Track [Page 20] 1142 1144 RFC 4523 LDAP X.509 Schema June 2006 1145 1146 1147 A.4. CertificatePairAssertion 1148 1149 CertificatePairAssertion = "{" [ sp cpa-issuedTo ] 1150 [sep sp cpa-issuedBy ] sp "}" 1151 ;; At least one of <cpa-issuedTo> and <cpa-issuedBy> MUST be present. 1152 1153 cpa-issuedTo = id-issuedToThisCAAssertion msp CertificateAssertion 1154 cpa-issuedBy = id-issuedByThisCAAssertion msp CertificateAssertion 1155 1156 A.5. CertificateListExactAssertion 1157 1158 CertificateListExactAssertion = "{" sp clea-issuer "," 1159 sp clea-thisUpdate 1160 [ "," sp clea-distributionPoint ] sp "}" 1161 1162 clea-issuer = id-issuer msp Name 1163 clea-thisUpdate = id-thisUpdate msp Time 1164 clea-distributionPoint = id-distributionPoint msp 1165 DistributionPointName 1166 1167 id-thisUpdate = %x74.68.69.73.55.70.64.61.74.65 ; 'thisUpdate' 1168 id-distributionPoint = 1169 %x64.69.73.74.72.69.62.75.74.69.6F.6E.50.6F.69.6E.74 1170 ; 'distributionPoint' 1171 1172 DistributionPointName = dpn-fullName / dpn-nameRelativeToCRLIssuer 1173 1174 dpn-fullName = id-fullName ":" GeneralNames 1175 dpn-nameRelativeToCRLIssuer = id-nameRelativeToCRLIssuer ":" 1176 RelativeDistinguishedName 1177 1178 id-fullName = %x66.75.6C.6C.4E.61.6D.65 ; 'fullName' 1179 id-nameRelativeToCRLIssuer = %x6E.61.6D.65.52.65.6C.61.74.69.76.65 1180 %x54.6F.43.52.4C.49.73.73.75.65.72 ; 'nameRelativeToCRLIssuer' 1181 1182 A.6. CertificateListAssertion 1183 1184 CertificateListAssertion = "{" [ sp cla-issuer ] 1185 [ sep sp cla-minCRLNumber ] 1186 [ sep sp cla-maxCRLNumber ] 1187 [ sep sp cla-reasonFlags ] 1188 [ sep sp cla-dateAndTime ] 1189 [ sep sp cla-distributionPoint ] 1190 [ sep sp cla-authorityKeyIdentifier ] sp "}" 1191 1192 cla-issuer = id-issuer msp Name 1193 cla-minCRLNumber = id-minCRLNumber msp CRLNumber 1194 cla-maxCRLNumber = id-maxCRLNumber msp CRLNumber 1195 1196 1197 1198 Zeilenga Standards Track [Page 21] 1199 1201 RFC 4523 LDAP X.509 Schema June 2006 1202 1203 1204 cla-reasonFlags = id-reasonFlags msp ReasonFlags 1205 cla-dateAndTime = id-dateAndTime msp Time 1206 1207 cla-distributionPoint = id-distributionPoint msp 1208 DistributionPointName 1209 1210 cla-authorityKeyIdentifier = id-authorityKeyIdentifier msp 1211 AuthorityKeyIdentifier 1212 1213 id-minCRLNumber = %x6D.69.6E.43.52.4C.4E.75.6D.62.65.72 1214 ; 'minCRLNumber' 1215 id-maxCRLNumber = %x6D.61.78.43.52.4C.4E.75.6D.62.65.72 1216 ; 'maxCRLNumber' 1217 id-reasonFlags = %x72.65.61.73.6F.6E.46.6C.61.67.73 ; 'reasonFlags' 1218 id-dateAndTime = %x64.61.74.65.41.6E.64.54.69.6D.65 ; 'dateAndTime' 1219 1220 CRLNumber = INTEGER-0-MAX 1221 1222 ReasonFlags = BIT-STRING 1223 / "{" [ sp reason-flag *( "," sp reason-flag ) ] sp "}" 1224 1225 reason-flag = id-unused 1226 / id-keyCompromise 1227 / id-cACompromise 1228 / id-affiliationChanged 1229 / id-superseded 1230 / id-cessationOfOperation 1231 / id-certificateHold 1232 / id-privilegeWithdrawn 1233 / id-aACompromise 1234 1235 id-unused = %x75.6E.75.73.65.64 ; 'unused' 1236 id-keyCompromise = %x6B.65.79.43.6F.6D.70.72.6F.6D.69.73.65 1237 ; 'keyCompromise' 1238 id-cACompromise = %x63.41.43.6F.6D.70.72.6F.6D.69.73.65 1239 ; 'cACompromise' 1240 id-affiliationChanged = 1241 %x61.66.66.69.6C.69.61.74.69.6F.6E.43.68.61.6E.67.65.64 1242 ; 'affiliationChanged' 1243 id-superseded = %x73.75.70.65.72.73.65.64.65.64 ; 'superseded' 1244 id-cessationOfOperation = 1245 %x63.65.73.73.61.74.69.6F.6E.4F.66.4F.70.65.72.61.74.69.6F.6E 1246 ; 'cessationOfOperation' 1247 id-certificateHold = %x63.65.72.74.69.66.69.63.61.74.65.48.6F.6C.64 1248 ; 'certificateHold' 1249 id-privilegeWithdrawn = 1250 %x70.72.69.76.69.6C.65.67.65.57.69.74.68.64.72.61.77.6E 1251 ; 'privilegeWithdrawn' 1252 1253 1254 1255 Zeilenga Standards Track [Page 22] 1256 1258 RFC 4523 LDAP X.509 Schema June 2006 1259 1260 1261 id-aACompromise = %x61.41.43.6F.6D.70.72.6F.6D.69.73.65 1262 ; 'aACompromise' 1263 1264 A.7. AlgorithmIdentifier 1265 1266 AlgorithmIdentifier = "{" sp ai-algorithm 1267 [ "," sp ai-parameters ] sp "}" 1268 1269 ai-algorithm = id-algorithm msp OBJECT-IDENTIFIER 1270 ai-parameters = id-parameters msp Value 1271 id-algorithm = %x61.6C.67.6F.72.69.74.68.6D ; 'algorithm' 1272 id-parameters = %x70.61.72.61.6D.65.74.65.72.73 ; 'parameters' 1273 1274 Author's Address 1275 1276 Kurt D. Zeilenga 1277 OpenLDAP Foundation 1278 1279 EMail: Kurt (a] OpenLDAP.org 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 Zeilenga Standards Track [Page 23] 1313 1315 RFC 4523 LDAP X.509 Schema June 2006 1316 1317 1318 Full Copyright Statement 1319 1320 Copyright (C) The Internet Society (2006). 1321 1322 This document is subject to the rights, licenses and restrictions 1323 contained in BCP 78, and except as set forth therein, the authors 1324 retain all their rights. 1325 1326 This document and the information contained herein are provided on an 1327 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 1328 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET 1329 ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, 1330 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE 1331 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 1332 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 1333 1334 Intellectual Property 1335 1336 The IETF takes no position regarding the validity or scope of any 1337 Intellectual Property Rights or other rights that might be claimed to 1338 pertain to the implementation or use of the technology described in 1339 this document or the extent to which any license under such rights 1340 might or might not be available; nor does it represent that it has 1341 made any independent effort to identify any such rights. Information 1342 on the procedures with respect to rights in RFC documents can be 1343 found in BCP 78 and BCP 79. 1344 1345 Copies of IPR disclosures made to the IETF Secretariat and any 1346 assurances of licenses to be made available, or the result of an 1347 attempt made to obtain a general license or permission for the use of 1348 such proprietary rights by implementers or users of this 1349 specification can be obtained from the IETF on-line IPR repository at 1350 http://www.ietf.org/ipr. 1351 1352 The IETF invites any interested party to bring to its attention any 1353 copyrights, patents or patent applications, or other proprietary 1354 rights that may cover technology that may be required to implement 1355 this standard. Please address the information to the IETF at 1356 ietf-ipr (a] ietf.org. 1357 1358 Acknowledgement 1359 1360 Funding for the RFC Editor function is provided by the IETF 1361 Administrative Support Activity (IASA). 1362 1363 1364 1365 1366 1367 1368 1369 Zeilenga Standards Track [Page 24] 1370 1372
Indexes created Tue Sep 15 00:24:42 UTC 2026