Subject: RE: again: pmiUser ...

From: "Matt Cooper" <[email-masked]>
Date: Mon, 30 Jan 2006 19:19:32 -0500

Perhaps I am incorrect, but I would think your initial finding of pmiUser ->
attributeCertificateAttribute would be an appropriate object class and
attribute.  At least one commercial product does this.

pmiUser OBJECT-CLASS ::= {
  SUBCLASS OF  {top}
  KIND         auxiliary
  MAY CONTAIN  {attributeCertificateAttribute}
  ID           id-oc-pmiUser
}

attributeCertificateAttribute ATTRIBUTE ::= {
  WITH SYNTAX             AttributeCertificate
  EQUALITY MATCHING RULE  attributeCertificateExactMatch
  ID                      id-at-attributeCertificate
}

http://www.itu.int/ITU-T/asn1/database/itu-t/x/x509/2000/AttributeCertificat
eDefinitions.html

Best Regards,

Matt

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Keutel, Jochen
Sent: Sunday, December 11, 2005 4:17 PM
To: [email-masked]
Subject: again: pmiUser ...

Hello,
   I didn't get any answer on the question I asked some days ago (see
below). So, let me ask this as follows:

Do you store attribute certificates in LDAP directories? If so:
Which object class are you using?

Bye, Jochen.

---

Hello,
   X.509 defines the LDAP object class pmiUser and the attribute
attributeCertificateAttribute.

I can't find these definitions in LDAP RFCs oder non-expired drafts ...
I found

http://tools.ietf.org/wg/pkix/draft-ietf-pkix-ldap-pmi-schema/draft-ietf-pki
x-ldap-pmi-schema-00.txt

- but it's from June, 2002 ...

Did I miss an I-D and/or RFC?

Regards,  Jochen.