rfc4523.txt

samba最新软件

     / gn-x400Address
     / gn-directoryName
     / gn-ediPartyName
     / gn-uniformResourceIdentifier
     / gn-iPAddress
     / gn-registeredID

gn-otherName = id-otherName ":" OtherName
gn-rfc822Name = id-rfc822Name ":" IA5String
gn-dNSName = id-dNSName ":" IA5String
gn-x400Address = id-x400Address ":" ORAddress
gn-directoryName = id-directoryName ":" Name
gn-ediPartyName = id-ediPartyName ":" EDIPartyName
gn-iPAddress = id-iPAddress ":" OCTET-STRING
gn-registeredID = gn-id-registeredID ":" OBJECT-IDENTIFIER

gn-uniformResourceIdentifier = id-uniformResourceIdentifier
     ":" IA5String

id-otherName = %x6F.74.68.65.72.4E.61.6D.65 ; 'otherName'
gn-id-registeredID = %x72.65.67.69.73.74.65.72.65.64.49.44
     ; 'registeredID'

OtherName = "{" sp on-type-id "," sp on-value sp "}"
on-type-id = id-type-id msp OBJECT-IDENTIFIER
on-value = id-value msp Value
     ;; <Value> as defined in Section 3 of [RFC3641]

id-type-id = %x74.79.70.65.2D.69.64 ; 'type-id'
id-value = %x76.61.6C.75.65 ; 'value'

ORAddress = dquote *SafeIA5Character dquote
SafeIA5Character = %x01-21 / %x23-7F / ; ASCII minus dquote
     dquote dquote ; escaped double quote
dquote = %x22 ; '"' (double quote)

;; Note: The <ORAddress> rule encodes the x400Address component
;; of a GeneralName as a character string between double quotes.
;; The character string is first derived according to Section 4.1
;; of [RFC2156], and then any embedded double quotes are escaped
;; by being repeated. This resulting string is output between
;; double quotes.

EDIPartyName = "{" [ sp nameAssigner "," ] sp partyName sp "}"
nameAssigner = id-nameAssigner msp DirectoryString
partyName = id-partyName msp DirectoryString
id-nameAssigner = %x6E.61.6D.65.41.73.73.69.67.6E.65.72
     ; 'nameAssigner'



Zeilenga                    Standards Track                    [Page 17]

RFC 4523                   LDAP X.509 Schema                   June 2006


id-partyName    = %x70.61.72.74.79.4E.61.6D.65 ; 'partyName'

aki-authorityCertSerialNumber = id-authorityCertSerialNumber
     msp CertificateSerialNumber

id-keyIdentifier = %x6B.65.79.49.64.65.6E.74.69.66.69.65.72
     ; 'keyIdentifier'
id-authorityCertIssuer =
     %x61.75.74.68.6F.72.69.74.79.43.65.72.74.49.73.73.75.65.72
     ; 'authorityCertIssuer'

id-authorityCertSerialNumber = %x61.75.74.68.6F.72.69.74.79.43
     %x65.72.74.53.65.72.69.61.6C.4E.75.6D.62.65.72
     ; 'authorityCertSerialNumber'

Time = time-utcTime / time-generalizedTime
time-utcTime = id-utcTime ":" UTCTime
time-generalizedTime = id-generalizedTime ":" GeneralizedTime
id-utcTime = %x75.74.63.54.69.6D.65 ; 'utcTime'
id-generalizedTime = %x67.65.6E.65.72.61.6C.69.7A.65.64.54.69.6D.65
     ; 'generalizedTime'

KeyUsage = BIT-STRING / key-usage-bit-list
key-usage-bit-list = "{" [ sp key-usage *( "," sp key-usage ) ] sp "}"

;; Note: The <key-usage-bit-list> rule encodes the one bits in
;; a KeyUsage value as a comma separated list of identifiers.

key-usage = id-digitalSignature
     / id-nonRepudiation
     / id-keyEncipherment
     / id-dataEncipherment
     / id-keyAgreement
     / id-keyCertSign
     / id-cRLSign
     / id-encipherOnly
     / id-decipherOnly

id-digitalSignature = %x64.69.67.69.74.61.6C.53.69.67.6E.61.74
     %x75.72.65 ; 'digitalSignature'
id-nonRepudiation   = %x6E.6F.6E.52.65.70.75.64.69.61.74.69.6F.6E
     ; 'nonRepudiation'
id-keyEncipherment  = %x6B.65.79.45.6E.63.69.70.68.65.72.6D.65.6E.74
     ; 'keyEncipherment'
id-dataEncipherment = %x64.61.74.61.45.6E.63.69.70.68.65.72.6D.65.6E
     %x74 ; "dataEncipherment'
id-keyAgreement     = %x6B.65.79.41.67.72.65.65.6D.65.6E.74
     ; 'keyAgreement'



Zeilenga                    Standards Track                    [Page 18]

RFC 4523                   LDAP X.509 Schema                   June 2006


id-keyCertSign      = %x6B.65.79.43.65.72.74.53.69.67.6E
     ; 'keyCertSign'
id-cRLSign          = %x63.52.4C.53.69.67.6E ; "cRLSign"
id-encipherOnly     = %x65.6E.63.69.70.68.65.72.4F.6E.6C.79
     ; 'encipherOnly'
id-decipherOnly     = %x64.65.63.69.70.68.65.72.4F.6E.6C.79
     ; 'decipherOnly'

AltNameType = ant-builtinNameForm / ant-otherNameForm

ant-builtinNameForm = id-builtinNameForm ":" BuiltinNameForm
ant-otherNameForm = id-otherNameForm ":" OBJECT-IDENTIFIER

id-builtinNameForm = %x62.75.69.6C.74.69.6E.4E.61.6D.65.46.6F.72.6D
     ; 'builtinNameForm'
id-otherNameForm   = %x6F.74.68.65.72.4E.61.6D.65.46.6F.72.6D
     ; 'otherNameForm'

BuiltinNameForm  = id-rfc822Name
     / id-dNSName
     / id-x400Address
     / id-directoryName
     / id-ediPartyName
     / id-uniformResourceIdentifier
     / id-iPAddress
     / id-registeredId

id-rfc822Name = %x72.66.63.38.32.32.4E.61.6D.65 ; 'rfc822Name'
id-dNSName = %x64.4E.53.4E.61.6D.65 ; 'dNSName'
id-x400Address  = %x78.34.30.30.41.64.64.72.65.73.73 ; 'x400Address'
id-directoryName = %x64.69.72.65.63.74.6F.72.79.4E.61.6D.65
     ; 'directoryName'
id-ediPartyName  = %x65.64.69.50.61.72.74.79.4E.61.6D.65
     ; 'ediPartyName'
id-iPAddress = %x69.50.41.64.64.72.65.73.73 ; 'iPAddress'
id-registeredId = %x72.65.67.69.73.74.65.72.65.64.49.64
     ; 'registeredId'

id-uniformResourceIdentifier = %x75.6E.69.66.6F.72.6D.52.65.73.6F.75
     %x72.63.65.49.64.65.6E.74.69.66.69.65.72
     ; 'uniformResourceIdentifier'

CertPolicySet = "{" sp CertPolicyId *( "," sp CertPolicyId ) sp "}"
CertPolicyId = OBJECT-IDENTIFIER

NameConstraintsSyntax = "{" [ sp ncs-permittedSubtrees ]
     [ sep sp ncs-excludedSubtrees ] sp "}"




Zeilenga                    Standards Track                    [Page 19]

RFC 4523                   LDAP X.509 Schema                   June 2006


ncs-permittedSubtrees = id-permittedSubtrees msp GeneralSubtrees
ncs-excludedSubtrees = id-excludedSubtrees  msp GeneralSubtrees

id-permittedSubtrees =
     %x70.65.72.6D.69.74.74.65.64.53.75.62.74.72.65.65.73
     ; 'permittedSubtrees'
id-excludedSubtrees =
     %x65.78.63.6C.75.64.65.64.53.75.62.74.72.65.65.73
     ; 'excludedSubtrees'

GeneralSubtrees = "{" sp GeneralSubtree
     *( "," sp GeneralSubtree ) sp "}"
GeneralSubtree  = "{" sp gs-base
     [ "," sp gs-minimum ]
     [ "," sp gs-maximum ] sp "}"

gs-base = id-base msp GeneralName
gs-minimum = id-minimum msp BaseDistance
gs-maximum = id-maximum msp BaseDistance

id-base = %x62.61.73.65 ; 'base'
id-minimum = %x6D.69.6E.69.6D.75.6D ; 'minimum'
id-maximum = %x6D.61.78.69.6D.75.6D ; 'maximum'

BaseDistance = INTEGER-0-MAX

A.3.  CertificatePairExactAssertion

  CertificatePairExactAssertion = "{" [ sp cpea-issuedTo ]
       [sep sp cpea-issuedBy ] sp "}"
  ;; At least one of <cpea-issuedTo> or <cpea-issuedBy> MUST be present.

  cpea-issuedTo = id-issuedToThisCAAssertion msp
       CertificateExactAssertion
  cpea-issuedBy = id-issuedByThisCAAssertion msp
       CertificateExactAssertion

  id-issuedToThisCAAssertion = %x69.73.73.75.65.64.54.6F.54.68.69.73
       %x43.41.41.73.73.65.72.74.69.6F.6E ; 'issuedToThisCAAssertion'
  id-issuedByThisCAAssertion = %x69.73.73.75.65.64.42.79.54.68.69.73
       %x43.41.41.73.73.65.72.74.69.6F.6E ; 'issuedByThisCAAssertion'










Zeilenga                    Standards Track                    [Page 20]

RFC 4523                   LDAP X.509 Schema                   June 2006


A.4.  CertificatePairAssertion

   CertificatePairAssertion = "{" [ sp cpa-issuedTo ]
        [sep sp cpa-issuedBy ] sp "}"
   ;; At least one of <cpa-issuedTo> and <cpa-issuedBy> MUST be present.

   cpa-issuedTo = id-issuedToThisCAAssertion msp CertificateAssertion
   cpa-issuedBy = id-issuedByThisCAAssertion msp CertificateAssertion

A.5.  CertificateListExactAssertion

   CertificateListExactAssertion = "{" sp clea-issuer ","
        sp clea-thisUpdate
        [ "," sp clea-distributionPoint ] sp "}"

   clea-issuer = id-issuer msp Name
   clea-thisUpdate = id-thisUpdate msp Time
   clea-distributionPoint = id-distributionPoint msp
        DistributionPointName

   id-thisUpdate = %x74.68.69.73.55.70.64.61.74.65 ; 'thisUpdate'
   id-distributionPoint =
        %x64.69.73.74.72.69.62.75.74.69.6F.6E.50.6F.69.6E.74
        ; 'distributionPoint'

   DistributionPointName = dpn-fullName / dpn-nameRelativeToCRLIssuer

   dpn-fullName = id-fullName ":" GeneralNames
   dpn-nameRelativeToCRLIssuer = id-nameRelativeToCRLIssuer ":"
        RelativeDistinguishedName

   id-fullName = %x66.75.6C.6C.4E.61.6D.65 ; 'fullName'
   id-nameRelativeToCRLIssuer = %x6E.61.6D.65.52.65.6C.61.74.69.76.65
        %x54.6F.43.52.4C.49.73.73.75.65.72 ; 'nameRelativeToCRLIssuer'

A.6.  CertificateListAssertion

   CertificateListAssertion = "{" [ sp cla-issuer ]
        [ sep sp cla-minCRLNumber ]
        [ sep sp cla-maxCRLNumber ]
        [ sep sp cla-reasonFlags ]
        [ sep sp cla-dateAndTime ]
        [ sep sp cla-distributionPoint ]
        [ sep sp cla-authorityKeyIdentifier ] sp "}"

   cla-issuer = id-issuer msp Name
   cla-minCRLNumber = id-minCRLNumber msp CRLNumber
   cla-maxCRLNumber = id-maxCRLNumber msp CRLNumber



Zeilenga                    Standards Track                    [Page 21]

RFC 4523                   LDAP X.509 Schema                   June 2006


   cla-reasonFlags = id-reasonFlags msp ReasonFlags
   cla-dateAndTime = id-dateAndTime msp Time

   cla-distributionPoint = id-distributionPoint msp
        DistributionPointName

   cla-authorityKeyIdentifier = id-authorityKeyIdentifier msp
        AuthorityKeyIdentifier

   id-minCRLNumber = %x6D.69.6E.43.52.4C.4E.75.6D.62.65.72
        ; 'minCRLNumber'
   id-maxCRLNumber = %x6D.61.78.43.52.4C.4E.75.6D.62.65.72
        ; 'maxCRLNumber'
   id-reasonFlags = %x72.65.61.73.6F.6E.46.6C.61.67.73 ; 'reasonFlags'
   id-dateAndTime = %x64.61.74.65.41.6E.64.54.69.6D.65 ; 'dateAndTime'

   CRLNumber = INTEGER-0-MAX

   ReasonFlags = BIT-STRING
        / "{" [ sp reason-flag *( "," sp reason-flag ) ] sp "}"

   reason-flag = id-unused
        / id-keyCompromise
        / id-cACompromise
        / id-affiliationChanged
        / id-superseded
        / id-cessationOfOperation
        / id-certificateHold
        / id-privilegeWithdrawn
        / id-aACompromise

   id-unused = %x75.6E.75.73.65.64 ; 'unused'
   id-keyCompromise = %x6B.65.79.43.6F.6D.70.72.6F.6D.69.73.65
        ; 'keyCompromise'
   id-cACompromise = %x63.41.43.6F.6D.70.72.6F.6D.69.73.65
        ; 'cACompromise'
   id-affiliationChanged =
        %x61.66.66.69.6C.69.61.74.69.6F.6E.43.68.61.6E.67.65.64
        ; 'affiliationChanged'
   id-superseded = %x73.75.70.65.72.73.65.64.65.64 ; 'superseded'
   id-cessationOfOperation =
        %x63.65.73.73.61.74.69.6F.6E.4F.66.4F.70.65.72.61.74.69.6F.6E
        ; 'cessationOfOperation'
   id-certificateHold = %x63.65.72.74.69.66.69.63.61.74.65.48.6F.6C.64
        ; 'certificateHold'
   id-privilegeWithdrawn =
        %x70.72.69.76.69.6C.65.67.65.57.69.74.68.64.72.61.77.6E
        ; 'privilegeWithdrawn'



Zeilenga                    Standards Track                    [Page 22]

RFC 4523                   LDAP X.509 Schema                   June 2006


   id-aACompromise = %x61.41.43.6F.6D.70.72.6F.6D.69.73.65
        ; 'aACompromise'

A.7.  AlgorithmIdentifier

   AlgorithmIdentifier = "{" sp ai-algorithm
        [ "," sp ai-parameters ] sp "}"

   ai-algorithm = id-algorithm msp OBJECT-IDENTIFIER
   ai-parameters = id-parameters msp Value
   id-algorithm = %x61.6C.67.6F.72.69.74.68.6D ; 'algorithm'
   id-parameters = %x70.61.72.61.6D.65.74.65.72.73 ; 'parameters'

Author's Address

   Kurt D. Zeilenga
   OpenLDAP Foundation

   EMail: [e-mail]
































Zeilenga                    Standards Track                    [Page 23]

RFC 4523                   LDAP X.509 Schema                   June 2006


Full Copyright Statement

   Copyright (C) The Internet Society (2006).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   [e-mail].

Acknowledgement

   Funding for the RFC Editor function is provided by the IETF
   Administrative Support Activity (IASA).







Zeilenga                    Standards Track                    [Page 24]