Subject: Adding a second Aux class to the Core Policy Model

From: [email-masked]
Date: Thu, 11 Feb 1999 08:42:32 -0500

In the current version of the Core Policy Model,
<draft-ietf-policy-core-schema-01.txt>, there is an Aux class
policyRuleContainmentAux class containing a multi-valued DN
pointer policyRulesAuxContainedSet.  This Aux class and
attribute are the LDAP "distillation" of five associations
from the DMTF CIM model:

   - ContainedPolicyRules, which ties PolicyGroup to PolicyRule
   - RuleWithSettingJurisdiction, which ties Setting to PolicyRule
   - RuleWithMseJurisdiction, which ties ManagedSystemElement to
     PolicyRule
   - RuleWithPartyJurisdiction, which ties Party to PolicyRule
   - RuleWithGroupJurisdiction, which ties Group to PolicyRule

The first of these associations represents the administrative
combination of a set of PolicyRules into a PolicyGroup.  The
remaining four represent the linkage between a system resource,
modeled as a Setting, ManagedSystemElement, Party, or Group,
and the PolicyRules that apply to it.

At our most recent DMTF SLA Policy WG meeting, we added four
other associations as well, between a Setting /
ManagedSystemElement / Party / Group and a PolicyGroup, to allow
a policy administrator to link a resource modeled by one of these
classes with a PolicyGroup representing a set of PolicyRules
that apply to it.  Consequently, if we want to keep the LDAP
Core Policy Schema in sync with the CIM model, we need to add
a second Aux class to it.  This second Aux class is a carbon
copy of policyRuleContainmentAuxClass, except that it provides
a linkage to a policyGroup rather than to a policyRule.  This new
class would also make the containedPolicyGroups attribute in
policyGroup unnecessary, in exactly the same way that the current
Aux class makes a containedPolicyRules attribute unnecessary.

The following sections define the second Aux class:

************ New text:  *****************************************

5.x  The Class policyGroupContainmentAuxClass

This auxiliary class provides a single, multi-valued attribute that
points to a set of policyGroups.  By attaching this attribute to
instances of various other classes, a policy administrator has a
flexible way of providing an entry point into the directory that
allows a client to locate and retrieve the policyGroups relevant
to it.

As was the case with policyRules, a policy administrator might have
several different pointers to a policyGroup in the overall directory
structure. The policyGroupContainmentAuxClass is the mechanism that
makes it possible for the policy administrator to define all these
pointers.

The class definition is as follows:

  NAME                 policyGroupContainmentAuxClass
  DESCRIPTION          An auxiliary class used to bind policyGroups
                       to an appropriate container object.
  DERIVED FROM         top
  TYPE                 auxiliary
  AUXILIARY CLASSES    none
  POSSIBLE SUPERIORS   container, organization,
                       organizationalUnit
  OID                  <to be assigned>
  MUST                 policyGroupsAuxContainedSet

5.x.1  The Attribute policyGroupsAuxContainedSet

This attribute provides an unordered set of DN pointers to one or more
policyGroups associated with the instance of a structural class to
which this attribute has been appended.  The attribute definition is:

  NAME           policyGroupsAuxContainedSet
  DESCRIPTION    Distinguished names of policyGroups associated in
                 some way with the instance to which this attribute
                 has been appended.  No order is implied.
  SYNTAX         DN
  OID            <to be assigned>
  EQUALITY       distinguishedNameMatch
  MULTI-VALUED

************ End new text:  *************************************

I'm not going to chase down all the updates right now, but several
sections of the document (3.4, 5.2, 5,2,3, possibly others) are hit
by the change to remove the containedPolicyGroups attribute from
policyGroup.

We can discuss this point further on the list, or at the interim
WG meeting next week.

Regards,
Bob

Bob Moore
IBM Networking Software
+1-919-254-4436
[email-masked]