Subject: New ABNF for core schema...

From: "Ryan Moats" <[email-masked]>
Date: Fri, 20 Aug 1999 08:27:43 -0500

Bob (and others)-

Here is the "new and improved" ABNF for the core schema.
It does not have the proposed DN list attribute that
Yoram is asking for.  However, adding that for a later
draft would be easy if we decide we want it and this
way Bob can get a new draft out for folks to review.

Rather than providing old text (like last time),
I've just number the sections with roman numerals,
each of which consists of an object class and associated
definitions.

I've changed the names of policyCondition and
policyAction to policyConditionAuxClass and
policyActionAuxClass.  This is because a typical LDAP
type person would expect policyCondition and
policyAction to be structural or abstract classes rather
than auxiliary.  If people want the other, we can
always change it back.

Lastly, my memory is that somewhere in the information
model and old schema drafts, there was a restriction
in where the policyGroup class could be located in
the DIT.  This restriction has been removed in this
ABNF (policyGroup objects can be located anywhere) to
minimize the amount of DIT specification we are making.

Have fun!
Ryan

=========ABNF

I. policy

     ( <oid-oc1> NAME 'policy'
       DESC 'An abstract class with four attributes for describing
	     a policy-related instance.'
       SUP top
       ABSTRACT
       MAY (cn $ caption $ description $ policyKeywords)
     )

     ( <oid-at1> NAME 'caption'
       DESC 'A one-line description of this policy-related object.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

     ( <oid-at2> NAME 'description'
       DESC 'A long description of this policy-related object.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

     ( <oid-at3> NAME 'policyKeywords'
       DESC 'A set of keywords to assist directory clients in locating
	     the policy objects applicable to them. Standard keyword
	     values are listed in the Policy Core Information Model
	     document.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
     )

II policyGroup

     ( <oid-oc2> NAME 'policyGroup'
       DESC 'A container for either a set of related policyRules or a
             set of related policyGroups.'
       SUP top
       MUST (policyGroupName)
     )

     ( <oid-oc2>
       NAME 'policyGroupContentRule'
       DESC 'shows what auxiliary classes go with this object'
       AUX (policyGroupContainmentAuxClass $ policyRuleContainmentAuxClass)
     )

     ( <oid-nf1> NAME 'policyGroupNameForm1'
       OC policyGroup
       MUST (cn)
     )

     ( 1 NAME 'policyGroupStructuralRule1'
       FORM policyGroupNameForm1
     )

     ( <oid-nf2> NAME 'policyGroupNameForm2'
       OC policyGroup
       MUST (policyGroupName)
     )

     ( 2 NAME 'policyGroupStructuralRule2'
       FORM policyGroupNameForm2
     )

     ( <oid-at4> NAME 'policyGroupName'
       DESC 'The user-friendly name of this policy group.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

III. policyRule

     ( <oid-oc3> NAME 'policyRule'
       DESC 'The central class for representing the
             "If Condition then Action" semantics associated with a
	      policy rule.'
       SUP top
       MUST (policyRuleName)
       MAY (policyRuleEnabled $ policyRuleConditionListType $
	    policyRuleValidityPeriodList $ policyRuleUsage $
            policyRulePriority $ policyRuleMandatory $
            policyRuleSequencedActions)
     )

     ( <oid-nf3> NAME 'policyRuleNameForm1'
       OC policyRule
       MUST (cn)
     )

     ( 3 NAME 'policyRuleStructuralRule1'
         FORM policyRuleNameForm1
         SUP 1 2
     )

     ( <oid-nf4> NAME 'policyRuleNameForm2'
       OC policyRule
       MUST (policyRuleName)
     )

     ( 4 NAME 'policyRuleStructuralRule2'
         FORM policyRuleNameForm2
         SUP 1 2
     )

     ( <oid-at5> NAME 'policyRuleName'
       DESC 'The user-friendly name of this policy rule.'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

     ( <oid-at6> NAME 'policyRuleEnabled'
       DESC 'An enumeration indicating whether a policy rule is
             administratively enabled, administratively disabled, or enabled
             for debug mode. The defined values for this attribute are
             enabled(1), disabled(2), and enabledForDebug(3).'
       SYNTAX INTEGER
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at7> NAME 'policyRuleConditionListType'
       DESC 'Indicates whether the list of policy conditions
             associated with this policy rule is in disjunctive normal
             form (DNF) or conjunctive normal form (CNF). Defined
	     values are DNF(1) and CNF(2).'
       SYNTAX INTEGER
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at8> NAME 'policyRuleValidityPeriodList'
       DESC 'An unordered list of strings of the form "n:DN",
             indicating an ordered set of policy actions to be performed if
	     the associated condition(s) of the policyRule evaluates to
	     true.'
       SYNTAX DirectoryString
       EQUALITY caseIgnoreSubstringsMatch
     )

     ( <oid-at9> NAME 'policyRuleUsage'
       DESC 'This attribute is used to provide guidelines on how this
             policy should be used.'
       SYNTAX DirectoryString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at10> NAME 'policyRulePriority'
       DESC 'A non-negative integer for prioritizing this policyRule
             relative to other policyRules. A larger value indicates a
	     higher priority.'
       SYNTAX INTEGER
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at11> NAME 'policyRuleMandatory'
       DESC 'A flag indicating that the evaluation of the
             policyConditions and execution of policyActions (if the
	     condition list evaluates to True) is required.'
       SYNTAX Boolean
       EQUALITY booleanMatch
       SINGLE-VALUE
     )

     ( <oid-at12> NAME 'policyRuleSequencedActions'
       DESC 'An enumeration indicating how to interpret the action
             ordering indicated via the policyRuleActionList
             attribute. The defined values for this attribute are
             mandatory(1), recommended(2), and dontCare(3).'
       SYNTAX Boolean
       EQUALITY booleanMatch
     )

IV. policyRuleConditionAssociation

     ( <oid-oc4> NAME 'policyRuleConditionAssociation'
       DESC 'The class contains attributes indicating a set of policy
             conditions that determine when the policyRule is
             applicable.'
       SUP policy
       MUST (policyRuleItemGroupNumber $ policyRuleItemNegated $
             policyRuleConditionName)
       MAY (policyRuleItemDN)
     )

     ( <oid-oc4>
       NAME 'policyRuleConditionAssociationContentRule'
       DESC 'shows what auxiliary classes go with this object'
       AUX (policyConditionAuxClass)
     )

     ( <oid-nf5> NAME 'policyRuleConditionAssociationNameForm1'
       OC policyRuleConditionAssociation
       MUST (cn)
     )

     ( 5 NAME 'policyRuleConditionAssociationStructuralRule1'
       FORM policyRuleConditionAssociationNameForm1
       SUP 3 4
     )

     ( <oid-nf6> NAME 'policyRuleConditionAssociationNameForm2'
       OC policyRuleConditionAssociation
       MUST (policyRuleConditionName)
     )

     ( 6 NAME 'policyRuleConditionAssociationStructuralRule2'
       FORM policyRuleConditionAssociationNameForm2
       SUP 3 4
     )

     ( <oid-at13>
       NAME 'policyRuleConditionName'
       DESC 'a user-friendly name for the association'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

     ( <oid-at14>
       NAME 'policyRuleItemGroupNumber'
       DESC 'The group number a policyRuleConditionItem or
             policyRuleActionItem is a member of'
       SYNTAX INTEGER
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at15>
       NAME 'policyRuleItemNegated'
       DESC 'Indicates if a policyRuleConditionItem is negated TRUE =
             negation'
       SYNTAX BOOLEAN
       EQUALITY integerMatch
       SINGLE-VALUE
     )

     ( <oid-at16>
       NAME 'policyRuleItemDN'
       DESC 'a DN pointer to the policy condition or policy action'
       SYNTAX DN
       EQUALITY distinguishedNameMatch
       SINGLE-VALUE
     )

V. policyRuleActionAssociation

     ( <oid-oc5> NAME 'policyRuleActionAssociation'
       DESC 'The class contains attributes indicating a set of policy
             actions to be performed if the associated condition(s) of the
             policy Rule evaluates to true.'
       SUP policy
       MUST (policyRuleItemGroupNumber $
             policyRuleActionName)
       MAY (policyRuleItemDN)
     )

     ( <oid-oc5>
       NAME 'policyRuleActionAssociationContentRule'
       DESC 'shows what auxiliary classes go with this object'
       AUX (policyActionAuxClass)
     )

     ( <oid-nf7> NAME 'policyRuleActionAssociationNameForm1'
       OC policyRuleActionAssociation
       MUST (cn)
     )

     ( 7 NAME 'policyRuleActionAssociationStructuralRule1'
       FORM policyRuleActionAssociationNameForm1
       SUP 3 4
     )

     ( <oid-nf8> NAME 'policyRuleActionAssociationNameForm2'
       OC policyRuleActionAssociation
       MUST (policyRuleActionAssociationName)
     )

     ( 8 NAME 'policyRuleActionAssociationStructuralRule2'
       FORM policyRuleActionAssociationNameForm2
       SUP 3 4
     )

     ( <oid-at17>
       NAME 'policyRuleActionAssociationName'
       DESC 'a user-friendly name for the policyRuleActionAssociation'
       SYNTAX IA5String
       EQUALITY caseExactIA5Match
       SINGLE-VALUE
     )

VI. policyConditionAuxClass

     ( <oid-oc6> NAME 'policyConditionAuxClass'
       DESC 'A class representing a condition to be evaluated in
             conjunction with a policy rule.'
       SUP top
       AUXILIARY
     )

VII. policyTimePeriodConditionAuxClass

     ( <oid-oc7> NAME 'policyTimePeriodConditionAuxClass'
       DESC 'A class that provides the capability of enabling /
             disabling a policy rule according to a pre- determined
	     schedule.'
       SUP policyConditionAuxClass
       AUXILIARY
       MAY (ptpConditionTime $ ptpConditionMonthOfYearMask $
            ptpConditionDayOfMonthMask $ ptpConditionDayOfWeekMask $
	    ptpConditionTimeOfDayMask $ ptpConditionTimeZone)
     )

     ( <oid-at19>
       NAME 'ptpConditionTime'
       DESC 'The range of calendar dates on which a policy rule is valid.'
       SYNTAX PrintableString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at20>
       NAME 'ptpConditionMonthOfYearMask'
       DESC 'A mask identifying the months of the year in which a
             policy rule is valid.'
       SYNTAX Printable
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at21>
       NAME 'ptpConditionDayOfMonthMask'
       DESC 'A mask identifying the days of the month on which a
             policy rule is valid.'
       SYNTAX PrintableString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at22>
       NAME 'ptpConditionDayOfWeekMask'
       DESC 'A mask identifying the days of the week on which a policy
             rule is valid.'
       SYNTAX PrintableString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

     ( <oid-at23>
       NAME 'ptpConditionTimeOfDayMask'
       DESC 'The range of times at which a policy rule is valid. If
             the second time is earlier than the first, then the interval
             spans midnight.'
       SYNTAX Printable
       EQUALITY caseIgnoreMatch
     )

     ( <oid-at24>
       NAME 'ptpConditionTimeZone'
       DESC 'The definition of the time zone for the
             policyTimePeriodCondition.'
       SYNTAX PrintableString
       EQUALITY caseIgnoreMatch
       SINGLE-VALUE
     )

VIII. vendorPolicyConditionAuxClass

     ( <oid-oc8> NAME 'vendorPolicyConditionAuxClass'
       DESC 'A class that defines a registered means to describe a
	     policy condition.'
       SUP policyConditionAuxClass
       AUXILIARY
       MUST (vendorPolicyConstraintData $
	     vendorPolicyConstraintEncoding)
     )

     ( <oid-at25>
       NAME 'vendorPolicyConstraintData'
       DESC 'Escape mechanism for representing constraints that have
	    not been modeled as specific attributes. The format of the
	    values is identified by the OID stored in the attribute
	    vendorPolicyConstraintEncoding.'
       SYNTAX OctetString
       EQUALITY octetStringMatch
     )

     ( <oid-at26>
       NAME 'vendorPolicyConstraintEncoding'
       DESC 'An OID identifying the format and semantics for this
             instance"s vendorPolicyConstraintData attribute.'
       SYNTAX OID
       EQUALITY objectIdentifierMatch
       SINGLE-VALUE
     )

IX. policyActionAuxClass

     ( <oid-oc9> NAME 'policyActionAuxClass'
       DESC 'A class representing an action to be performed as a
             result of a policy rule.'
       SUP top
       AUXILIARY
     )

X. vendorPolicyActionAuxClass

     ( <oid-oc10> NAME 'vendorPolicyActionAuxClass'
       DESC 'A class that defines a registered means to describe a
             policy action.'
       SUP policyActionAuxClass
       AUXILIARY
       MUST (vendorPolicyActionData $ vendorPolicyActionEncoding)
     )

     ( <oid-at28>
       NAME 'vendorPolicyActionData'
       DESC 'Escape mechanism for representing actions that have not
	     been modeled as specific attributes. The format of the
	     values is identified by the OID stored in the attribute
	     vendorPolicyActionEncoding.'
       SYNTAX OctetString
       EQUALITY octetStringMatch
     )

     ( <oid-at29>
       NAME 'vendorPolicyActionEncoding'
       DESC 'An OID identifying the format and semantics for this
             instance"s vendorPolicyActionData attribute.'
       SYNTAX OID
       EQUALITY objectIdentifierMatch
       SINGLE-VALUE
     )

XI. policyConditionInstance

     ( <oid-oc11> NAME 'policyConditionInstance'
       DESC 'A structural class that contains a reusable condition'
       SUP policy
       MUST (policyConditionName)
     )

     ( <oid-oc11>
       NAME 'policyConditionInstanceContentRule'
       DESC 'shows what auxiliary classes go with this group'
       AUX (policyConditionAuxClass)
     )

     ( <oid-nf9> NAME 'policyConditionInstanceNameForm1'
       OC policyConditionInstance
       MUST (cn)
     )

     ( 9 NAME 'policyConditionInstanceStructuralRule1'
       FORM policyConditionInstanceNameForm1
     )

     ( <oid-nf10> NAME 'policyConditionInstanceNameForm2'
       OC policyConditionInstance
       MUST (policyConditionName)
     )

     ( 10 NAME 'policyConditionInstanceStructuralRule2'
       FORM policyConditionInstanceNameForm2
     )

XII. policyActionInstance

     ( <oid-oc12> NAME 'policyActionInstance'
       DESC 'A structural class that contains a reusable Action'
       SUP policy
       MUST (policyActionName)
     )

     ( <oid-oc12>
       NAME 'policyActionInstanceContentRule'
       DESC 'shows what auxiliary classes go with this group'
       AUX (policyActionAuxClass)
     )

     ( <oid-nf11> NAME 'policyActionInstanceNameForm1'
       OC policyActionInstance
       MUST (cn)
     )

     ( 11 NAME 'policyActionInstanceStructuralRule1'
       FORM policyActionInstanceNameForm1
     )

     ( <oid-nf12> NAME 'policyActionInstanceNameForm2'
       OC policyActionInstance
       MUST (policyActionName)
     )

     ( 12 NAME 'policyActionInstanceStructuralRule2'
       FORM policyActionInstanceNameForm2
     )

XIII. policyElementAuxClass

     ( <oid-oc13> NAME 'policyElementAuxClass'
       DESC 'An auxiliary class used to tag instances of classes
	     defined outside the realm of policy as relevant to a
	     particular policy specification.'
       SUP policy
       AUXILIARY
     )

XIV. policySubtreesPtrAuxClass

     ( <oid-oc14> NAME 'policySubtreesPtrAuxClass'
       DESC 'An auxiliary class providing a DN pointer to roots of DIT

             subtrees contained policy-related objects.'
       SUP top
       AUXILIARY
       MUST (policySubtreesAuxContainedSet)
     )

     ( <oid-at30>
       NAME 'policySubtreesAuxContainedSet'
       DESC 'Distinguished names of objects that serve as roots for
             DIT subtrees containing policy-related objects. No order
	     is implied.'
       SYNTAX DN
       EQUALITY distinguishedNameMatch
     )

XV. policyGroupContainmentAuxClass

     ( <oid-oc15> NAME 'policyGroupContainmentAuxClass'
       DESC 'An auxiliary class used to bind policyGroups to an
             appropriate container object.'
       SUP top
       AUXILIARY
       MUST (policyGroupsAuxContainedSet)
     )

     ( <oid-at31>
       NAME 'policyGroupsAuxContainedSet'
       DESC 'Distinguished names of policyGroups associated in some
             way with the instance to which this attribute has been
             appended. No order is implied.'
       SYNTAX DN
       EQUALITY distinguishedNameMatch
     )

XVI. policyRuleContainmentAuxClass

     ( <oid-oc16> NAME 'policyRuleContainmentAuxClass'
       DESC 'An auxiliary class used to bind policyRules to an
             appropriate container object.'
       SUP top
       AUXILIARY
       MUST (policyRulesAuxContainedSet)
     )

     ( <oid-at32>
       NAME 'policyRulesAuxContainedSet'
       DESC 'Distinguished names of policyRules associated in some way
             with the instance to which this attribute has been
             appended. No order is implied.'
       SYNTAX DN
       EQUALITY distinguishedNameMatch
     )