INTERNET-DRAFT S. Legg draft-legg-xed-schema-00.txt Adacel Technologies Intended Category: Standard Track D. Prager Deakin University August 7, 2003 XED: Schema Operational Attributes Copyright (C) The Internet Society (2003). All Rights Reserved. Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress". The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. Distribution of this document is unlimited. Comments should be sent to the authors. This Internet-Draft expires on 7 February 2004. Abstract This document defines additional subschema operational attributes for the XML Enabled Directory (XED) that allow user defined attribute syntaxes to be imported into a directory server. User defined syntaxes specified in XML Schema, RELAX NG or Abstract Syntax Notation One (ASN.1), or specified as a document type declaration (DTD), are supported. Legg & Prager Expires 7 February 2004 [Page 1] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 Table of Contents 1. Introduction .................................................. 2 2. Conventions ................................................... 2 3. Additional System Schema ...................................... 3 3.1 The Schema Identity Syntax ................................ 3 3.2 The Identified Schema Syntax .............................. 3 3.3 The Identified DTD Syntax ................................. 4 3.4 The schemaIdentityMatch Matching Rule ..................... 5 3.5 The declarations Attribute ................................ 5 3.6 The doctypedecls Attribute ................................ 6 4. Referencing Imported Schemas .................................. 6 5. Example ....................................................... 7 6. IANA Considerations ........................................... 11 7. Security Considerations ....................................... 12 8. Acknowledgements .............................................. 12 9. Normative References .......................................... 12 10. Informative References ....................................... 14 11. Intellectual Property Notice ................................. 14 12. Copyright Notice ............................................. 15 13. Authors' Addresses ........................................... 15 Appendix A. XED Schema in ASN.1 .................................. 16 Appendix B. XED Schema in ASN.1 Schema ........................... 17 1. Introduction This document defines additional subschema operational attributes for the XML Enabled Directory (XED) [XED] that allow user defined attribute syntaxes to be imported into a directory server. User defined syntaxes specified in XML Schema [XSD1], RELAX NG [RNG] or Abstract Syntax Notation One (ASN.1) [ASD] [X680], or specified as a document type declaration (DTD) [XML], are supported. The Attribute Type Description syntax [SYNTAX] is extended to enable definitions from an imported user defined schema to be referenced in the definition of the syntax of an attribute type. 2. Conventions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", and "MAY" in this document are to be interpreted as described in RFC 2119 [BCP14]. The key word "OPTIONAL" is exclusively used with its ASN.1 meaning. Throughout this document the term "type" is always qualified as either an attribute type, ASN.1 type, or XML Schema type, as Legg & Prager Expires 7 February 2004 [Page 2] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 appropriate. This specification makes use of definitions from the XML Information Set (Infoset) [ISET]. In particular, information item property names are presented per the Infoset, e.g. [local name]. In the sections that follow, the term "element" shall be taken to mean an Infoset element information item. The term "attribute" shall be taken to mean a directory attribute, not an Infoset attribute information item. This document uses the namespace prefix "asn1:" to stand for the namespace name "http://xmled.info/ns/ASN.1/0702/00" though in practice any valid namespace prefix is permitted. 3. Additional System Schema Additional subschema operational attributes are defined to hold used supplied schema definitions. These attributes require the definition of new attribute syntaxes and a new matching rule [MODELS]. 3.1 The Schema Identity Syntax A value of the Schema Identity syntax is a URI [URI] identifying a schema definition document. The LDAP definition for the Schema Identity syntax is: ( 1.2.36.79672281.1.5.4 DESC 'Schema Identity' ) The LDAP-specific encoding for a value of the Schema Identity syntax is the URI character string. The Schema Identity syntax corresponds to the SchemaIdentity ASN.1 type [GLUE]. 3.2 The Identified Schema Syntax A value of the Identified Schema syntax is a URI identifying a schema definition along with the schema definition document itself. The LDAP definition for the Identified Schema syntax is: ( 1.2.36.79672281.1.5.5 DESC 'Identified Schema' ) Legg & Prager Expires 7 February 2004 [Page 3] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 The ASN.1 type corresponding to the Identified Schema syntax is defined as follows, assuming AUTOMATIC TAGS: IdentifiedSchema ::= SEQUENCE { identifier SchemaIdentity, definitions AnyType (WITH COMPONENTS { ..., content (CONSTRAINED BY { -- contains a single child element, -- either asn1:schema, xsd:schema or -- rng:grammar -- }) }) The content component of the AnyType type is constrained to contain a child element which is one of: a) an element with the [local name] "schema" and [namespace name] "http://xmled.info/ns/ASN.1/0702/00" (i.e. an ASN.1 Schema), b) an element with the [local name] "schema" and [namespace name] "http://www.w3.org/2001/XMLSchema" (i.e. an XML Schema), c) an element with the [local name] "grammar" and [namespace name] "http://relaxng.org/ns/structure/1.0" (i.e. a RELAX NG schema). The LDAP-specific encoding of a value of the Identified Schema syntax is defined to be the same as the encoding of the value according to the "transfer-dxer" encoding option [XFER]. 3.3 The Identified DTD Syntax A value of the Identified DTD syntax is a URI identifying the DTD along with the DTD document itself. The LDAP definition for the Identified DTD syntax is: ( 1.2.36.79672281.1.5.6 DESC 'Identified DTD' ) The ASN.1 type corresponding to the Identified DTD syntax is defined as follows, assuming AUTOMATIC TAGS: IdentifiedDTD ::= SEQUENCE { identifier SchemaIdentity, definitions UTF8String (CONSTRAINED BY { -- contains text conforming to -- the prolog production of XML -- }) } The definitions component of the IdentifiedDTD type is constrained to Legg & Prager Expires 7 February 2004 [Page 4] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 contain text conforming to the prolog production of XML [XML], which in particular contains a doctypedecl (DTD). Note that in the DXER encoding [DXER] of a value of the IdentifiedDTD type, markup in the definitions component must be escaped. This is most easily achieved by encoding the string value of the definitions component within a CDATA section. 3.4 The schemaIdentityMatch Matching Rule The schemaIdentityMatch matching rule compares an assertion value of the Schema Identity syntax to an attribute value of a syntax (e.g the Identified Schema syntax or the Identified DTD syntax) whose corresponding ASN.1 type is a SEQUENCE with a mandatory first component of the SchemaIdentity ASN.1 type. Note that the assertion syntax of this matching rule differs from the attribute syntax of attributes for which this is the equality matching rule. The rule evaluates to TRUE if and only if the assertion value and the first component of the attribute value have the same number of characters and corresponding characters have the same code point. The LDAP-style definition for the schemaIdentityMatch matching rule is: ( 1.2.36.79672281.1.13.10 NAME 'schemaIdentityMatch' SYNTAX 1.2.36.79672281.1.5.4 ) The X.500-style definition for the schemaIdentityMatch matching rule is: schemaIdentityMatch MATCHING-RULE ::= { SYNTAX SchemaIdentity ID { 1 2 36 79672281 1 13 10 } } 3.5. The declarations Attribute User defined schema documents, other than DTDs, are imported into a XED server as values of the declarations attribute in the subschema subentry [MODELS]. A particular schema document potentially appears in more than one subschema subentry, in which case the same identifier MUST be used for the schema document throughout the Directory Information Tree (DIT) [MODELS]. The LDAP-style definition for the declarations attribute is: Legg & Prager Expires 7 February 2004 [Page 5] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 ( 1.2.36.79672281.1.21.0 NAME 'declarations' EQUALITY schemaIdentityMatch SYNTAX 1.2.36.79672281.1.5.5 USAGE directoryOperation ) The X.500-style definition for the declarations attribute is: declarations ATTRIBUTE ::= { WITH SYNTAX IdentifiedSchema EQUALITY MATCHING RULE schemaIdentityMatch USAGE directoryOperation ID { 1 2 36 79672281 1 21 0 } } 3.6 The doctypedecls Attribute User defined DTDs are imported into a XED server as values of the doctypedecls attribute in the subschema subentry. A particular DTD potentially appears in more than one subschema subentry, in which case the same identifier MUST be used for the DTD throughout the DIT. The LDAP-style definition for the doctypedecls attribute is: ( 1.2.36.79672281.1.21.1 NAME 'doctypedecls' EQUALITY schemaIdentityMatch SYNTAX 1.2.36.79672281.1.5.6 USAGE directoryOperation ) The X.500-style definition for the doctypedecls attribute is: doctypedecls ATTRIBUTE ::= { WITH SYNTAX IdentifiedDTD EQUALITY MATCHING RULE schemaIdentityMatch USAGE directoryOperation ID { 1 2 36 79672281 1 21 1 } } 4. Referencing Imported Schemas Since the second edition of X.500, users have theoretically been able to import their own attribute syntax definitions into subschema in the form of ASN.1 type definitions. The attributeSyntax component of the AttributeTypeDescription ASN.1 type [X501] (the associated ASN.1 type for the Attribute Type Description syntax [SYNTAX]) is a character string permitted to contain the text of an ASN.1 type definition. However, the LDAP-specific encoding of the AttributeTypeDescription ASN.1 type replaces the character string with an OBJECT IDENTIFIER [X680], effectively allowing only Legg & Prager Expires 7 February 2004 [Page 6] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 predefined syntaxes in LDAP. This specification extends the LDAP-specific encoding of the Attribute Type Description syntax to include a field to render the character string content of the attributeSyntax component, and additionally permits the syntax to be described using ASN.1 Schema, which is more easily parsed than ASN.1 type notation. The XED specification for integrating schema languages [GLUE] enables XML Schema, RELAX NG and DTD definitions to be simply referenced from an ASN.1 type definition. The Augmented Backus-Naur Form (ABNF) [ABNF] rule [MODELS] is extended by the inclusion of the following ABNF placed immediately following the ABNF for the optional SYNTAX field: [ SP "SYNTAX-DEFINITION" SP qdstring ] The content corresponding to the rule is the character string content of the attributeSyntax component of an instance of the AttributeTypeDescription ASN.1 type. The attributeSyntax component is permitted to contain any character string which is a valid ASN.1 Schema type definition (i.e. an ASN.1 Schema element), in addition to the content already prescribed by X.501 [X501]. An attribute syntax defined through a SYNTAX-DEFINITION field is not required to have an associated syntax object identifier [SYNTAX] (thus an attribute definition with a SYNTAX-DEFINITION field is not required to also have a SYNTAX field). If the SYNTAX-DEFINITION string contains an ASN.1 Schema element and the SYNTAX field is absent then the LDAP-specific encoding for values of the attribute is assumed to be the same as the "transfer-dxer" encoding. 5. Example Suppose a directory administrator wishes to define two new attributes to hold data comforming to, the Address datatype from Addresses for International Purchase Order schema (address.xsd) [XSD0], and the element from the International Purchase Order Schema (ipo.xsd) [XSD0]. The first step is to install the schema definitions into the subschema subentry. Using LDAP, this is done by adding the two Legg & Prager Expires 7 February 2004 [Page 7] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 following (much abbreviated) values to the declarations attribute in the subschema subentry: http://www.example.com/schemas/ipo.xsd International Purchase order schema for Example.com Copyright 2000 Example.com. All rights reserved. etc. http://www.example.com/schemas/address.xsd Addresses for International Purchase order schema Copyright 2000 Example.com. All rights reserved. etc. Note that the LDAP-specific encoding for values of the declarations attribute is exactly the same as the "transfer-dxer" encoding. Legg & Prager Expires 7 February 2004 [Page 8] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 The value could also be added using XLDAP [XLDAP], using exactly the same markup for the elements. An attribute with the Address datatype as its syntax is defined for LDAP like so: ( 1.2.36.79672281.1.4.1.0 NAME 'ipo-address' SYNTAX-DEFINITION '') which is also the LDAP-specific encoding of the value of the Attribute Type Description syntax that must be added to the attributeTypes attribute in the subschema subentry to publish the definition of the ipo-address attribute. The "transfer-dxer" encoding for the definition of the ipo-address attribute is: 1.2.36.79672281.1.4.1.0 ipo-address ]]> The attributeSyntax component is a DirectoryString [X501] hence markup embedded in it must be escaped (in this case using a CDATA section). The definition of the ipo-address attribute could also be added to a subschema subentry using XLDAP, using exactly the same markup for the element. An attribute whose values each contain a single element is defined for LDAP like so: ( 1.2.36.79672281.1.4.1.1 NAME 'purchaseOrder' SYNTAX-DEFINITION Legg & Prager Expires 7 February 2004 [Page 9] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 ' 1.2.36.79672281.1.4.1.1 purchaseOrder Note the correspondence between the content of the fields in the information objects, the SYNTAX-DEFINITION fields in the LDAP attribute definitions, and the components in the "transfer-dxer" encodings of AttributeTypeDescription. 6. IANA Considerations The Internet Assigned Numbers Authority (IANA) is requested to update the LDAP descriptors registry [BCP64] as indicated by the following templates: Subject: Request for LDAP Descriptor Registration Descriptor (short name): schemaIdentityMatch Object Identifier: 1.2.36.79672281.1.13.10 Person & email address to contact for further information: Steven Legg Usage: other (matching rule) Specification: RFC XXXX Author/Change Controller: IESG Subject: Request for LDAP Descriptor Registration Descriptor (short name): declarations Object Identifier: 1.2.36.79672281.1.21.0 Legg & Prager Expires 7 February 2004 [Page 11] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 Person & email address to contact for further information: Steven Legg Usage: attribute type Specification: RFC XXXX Author/Change Controller: IESG Subject: Request for LDAP Descriptor Registration Descriptor (short name): doctypedecls Object Identifier: 1.2.36.79672281.1.21.1 Person & email address to contact for further information: Steven Legg Usage: attribute type Specification: RFC XXXX Author/Change Controller: IESG The object identifiers have been assigned for use in this specification by Adacel Technologies, under an arc assigned to Adacel by Standards Australia. 7. Security Considerations Attributes of directory entries are used to provide descriptive information about the real-world objects they represent, which can be people, organizations and devices, among other things. Most countries have privacy laws regarding the publication of information about people. 8. Acknowledgements This document and the technology it describes are a product of a joint research project between Adacel Technologies Limited and Deakin University on leveraging existing directory technology to produce an XML-based directory service. 9. Normative References [BCP14] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [ABNF] Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", RFC 2234, November 1997. [URI] Berners-Lee, T., Fielding, R. and L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax", RFC 2396, August 1998. Legg & Prager Expires 7 February 2004 [Page 12] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 [BCP64] Zeilenga, K., "Internet Assigned Numbers Authority (IANA) Considerations for the Lightweight Directory Access Protcol (LDAP)", BCP 64, RFC 3383, September 2002. [MODELS] Zeilenga, K., "LDAP: Directory Information Models", draft-ietf-ldapbis-models-xx.txt, a work in progress, March 2003. [SYNTAX] Legg, S. and K. Dally, "LDAP: Syntaxes and Matching Rules", draft-ietf-ldapbis-syntaxes-xx.txt, a work in progress, June 2003. [XFER] Legg, S., "LDAP: Transfer Encoding Options", draft-legg-ldap-transfer-xx.txt, a work in progress, August 2003. [GLUE] Legg, S. and D. Prager, "XED: Schema Language Integration", draft-legg-xed-glue-xx.txt, a work in progress, August 2003. [ASD] Legg, S. and D. Prager, "ASN.1 Schema: An XML Representation for ASN.1 Specifications", draft-legg-xed-asd-xx.txt, a work in progress, August 2003. [DXER] Legg, S. and D. Prager, "Directory XML Encoding Rules for ASN.1 Types", draft-legg-xed-dxer-xx.txt, a work in progress, August 2003. [X501] ITU-T Recommendation X.501 (02/01) | ISO/IEC 9594-2:2001, Information technology - Open Systems Interconnection - The Directory: Models [X680] ITU-T Recommendation X.680 (07/02) | ISO/IEC 8824-1:2002, Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation [XML] Bray, T., Paoli, J., Sperberg-McQueen, M. and E. Maler, "Extensible Markup Language (XML) 1.0 (Second Edition)", W3C Recommendation, http://www.w3.org/TR/2000/REC- xml-20001006, October 2000. [ISET] Cowan, J. and R. Tobin, "XML Information Set", http://www.w3.org/TR/2001/REC-xml-infoset-20011024, October 2001. [XSD1] Thompson, H., Beech, D., Maloney, M. and N. Mendelsohn, "XML Schema Part 1: Structures", W3C Recommendation, http://www.w3.org/TR/2001/REC-xmlschema-1-20010502, May Legg & Prager Expires 7 February 2004 [Page 13] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 2001. [RNG] Clark, J. and M. Makoto, "RELAX NG Tutorial", OASIS Committee Specification, http://www.oasis- open.org/committees/relax-ng/tutorial-20011203.html, December 2001. 10. Informative References [BCP11] Hovey, R. and S. Bradner, "The Organizations Involved in the IETF Standards Process", BCP 11, RFC 2028, October 1996. [XED] Legg, S. and D. Prager, "The XML Enabled Directory", draft- legg-xed-roadmap-xx.txt, a work in progress, August 2003. [XLDAP] Legg, S. and D. Prager, "XML Lightweight Directory Access Protocol", draft-legg-xed-xldap-xx.txt, a work in progress, August 2003. [XSD0] Fallside, D., "XML Schema Part 0: Primer", W3C Recommendation, http://www.w3.org/TR/2001/REC- xmlschema-0-20010502, May 2001. 11. Intellectual Property Notice The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. [BCP11] Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director. Legg & Prager Expires 7 February 2004 [Page 14] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 12. Copyright Notice Copyright (C) The Internet Society (2003). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 13. Authors' Addresses Dr. Steven Legg Adacel Technologies Ltd. 250 Bay Street Brighton, Victoria 3186 AUSTRALIA Phone: +61 3 8530 7710 Fax: +61 3 8530 7888 EMail: steven.legg@adacel.com.au Dr. Daniel Prager C/o Professor Lynn Batten Department of Computing and Mathematics Deakin University Geelong, Victoria 3217 AUSTRALIA Legg & Prager Expires 7 February 2004 [Page 15] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 EMail: dan@layabout.net EMail: lmbatten@deakin.edu.au Appendix A. XED Schema in ASN.1 This appendix is normative. XEDSchemaOperationalAttributes {iso(1) 2 36 79672281 xed(3) module(0) schema(2)} -- Copyright (C) The Internet Society (2003). This version of -- this ASN.1 module is part of RFC XXXX; see the RFC itself -- for full legal notices. -- The namespace name for this module is: -- http://xmled.info/ns/XED/1/XEDSchemaOperationalAttributes/00 -- The SchemaIdentity for this module is: -- http://xmled.info/id/XED/1/XEDSchemaOperationalAttributes/00 DEFINITIONS AUTOMATIC TAGS EXTENSIBILITY IMPLIED ::= BEGIN IMPORTS ATTRIBUTE, MATCHING-RULE FROM InformationFramework {joint-iso-itu-t ds(5) module(1) informationFramework(1) 4} AnyType, AnyURI FROM SchemaLanguageIntegration {iso(1) 2 36 79672281 xed(3) module(0) sli(1)} ; SchemaIdentity ::= AnyURI schemaIdentityMatch MATCHING-RULE ::= { SYNTAX SchemaIdentity ID { 1 2 36 79672281 1 13 10 } } IdentifiedSchema ::= SEQUENCE { identifier SchemaIdentity, definitions AnyType (WITH COMPONENTS { ..., content (CONSTRAINED BY { -- contains a single child element, -- either asn1:schema, xsd:schema or Legg & Prager Expires 7 February 2004 [Page 16] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 -- rng:grammar -- }) }) } declarations ATTRIBUTE ::= { WITH SYNTAX IdentifiedSchema EQUALITY MATCHING RULE schemaIdentityMatch USAGE directoryOperation ID { 1 2 36 79672281 1 21 0 } } IdentifiedDTD ::= SEQUENCE { identifier SchemaIdentity, definitions UTF8String (CONSTRAINED BY { -- contains text conforming to -- the prolog production of XML -- }) } doctypedecls ATTRIBUTE ::= { WITH SYNTAX IdentifiedDTD EQUALITY MATCHING RULE schemaIdentityMatch USAGE directoryOperation ID { 1 2 36 79672281 1 21 1 } } END Appendix B. XED Schema in ASN.1 Schema This appendix is non-normative. Legg & Prager Expires 7 February 2004 [Page 17] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 Legg & Prager Expires 7 February 2004 [Page 18] INTERNET-DRAFT XED: Schema Operational Attributes August 7, 2003 Legg & Prager Expires 7 February 2004 [Page 19]