ANSI INCITS ISO IEC 9594-4-2001 Information technology Open Systems Interconnection The Directory Procedures for distributed operation (Adopted by INCITS).pdf

1、Adopted by INCITS (InterNational Committee for Information Technology Standards) as an American National Standard.Date of ANSI Approval: 12/24/2003Published by American National Standards Institute,25 West 43rd Street, New York, New York 10036Copyright 2003 by Information Technology Industry Council

2、 (ITI).All rights reserved.These materials are subject to copyright claims of International Standardization Organization (ISO), InternationalElectrotechnical Commission (IEC), American National Standards Institute (ANSI), and Information Technology Industry Council(ITI). Not for resale. No part of t

3、his publication may be reproduced in any form, including an electronic retrieval system, withoutthe prior written permission of ITI. All requests pertaining to this standard should be submitted to ITI, 1250 Eye Street NW,Washington, DC 20005.Printed in the United States of AmericaReference numberISO

4、/IEC 9594-4:2001(E)ISO/IEC 2001INTERNATIONAL STANDARD ISO/IEC9594-4Fourth edition2001-12-15Information technology Open Systems Interconnection The Directory: Procedures for distributed operation Technologies de linformation Interconnexion de systmes ouverts (OSI) Lannuaire: Procdures pour le fonctio

5、nnement rparti ISO/IEC 9594-4:2001(E) PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing t

6、he editing. In downloading this file, parties accept therein the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file

7、can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretar

8、iat at the address given below. ISO/IEC 2001 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the ad

9、dress below or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published by ISO in 2002 Printed in Switzerland ii ISO/IEC 2001 All rights reservedISO/IEC 9594

10、-4:2001 (E) ISO/IEC 2001 All rights reserved iiiCONTENTS Page SECTION 1 GENERAL 1 1 Scope . 1 2 Normative references 1 2.1 Identical Recommendations | International Standards. 1 3 Definitions 2 3.1 OSI Reference Model Definitions . 2 3.2 Basic Directory Definitions. 2 3.3 Directory Model Definitions

11、 . 2 3.4 DSA Information Model definitions 2 3.5 Directory replication definitions 3 3.6 Distributed operation definitions. 3 4 Abbreviations 5 5 Conventions 5 SECTION 2 OVERVIEW . 6 6 Overview 6 SECTION 3 DISTRIBUTED DIRECTORY MODELS 7 7 Distributed Directory System Model 7 8 DSA Interactions Model

12、. 7 8.1 Decomposition of a request . 8 8.2 Uni-chaining 8 8.3 Multi-chaining. 8 8.4 Referral 10 8.5 Mode Determination 11 SECTION 4 DSA ABSTRACT SERVICE . 12 9 Overview of DSA Abstract Service 12 10 Information types 12 10.1 Introduction . 12 10.2 Information types defined elsewhere. 12 10.3 Chainin

13、g Arguments 13 10.4 Chaining Results 15 10.5 Operation Progress 16 10.6 Trace Information 16 10.7 Reference Type 17 10.8 Access point information. 17 10.9 Exclusions . 18 10.10 Continuation Reference. 18 11 Bind and Unbind. 19 11.1 DSA Bind 19 11.2 DSA Unbind 20 12 Chained operations . 20 12.1 Chain

14、ed operations 20 12.2 Chained Abandon operation 21 12.3 Chained operations and protocol version 21 13 Chained errors. 21 13.1 Introduction . 21 13.2 DSA Referral. 22 ISO/IEC 9594-4:2001 (E) iv ISO/IEC 2001 All rights reservedPage SECTION 5 DISTRIBUTED PROCEDURES. 23 14 Introduction 23 14.1 Scope and

15、 Limits . 23 14.2 Conformance . 23 14.3 Conceptual model 23 14.4 Individual and cooperative operation of DSAs 23 14.5 Cooperative agreements between DSAs 24 15 Distributed Directory behaviour . 24 15.1 Cooperative fulfilment of operations. 24 15.2 Phases of operation processing 24 15.3 Managing Dist

16、ributed Operations . 25 15.4 Loop handling 26 15.5 Other considerations for distributed operation 26 15.6 Authentication of Distributed Operations 28 16 The Operation Dispatcher. 28 16.1 General Concepts. 28 16.2 Procedures of the Operation Dispatcher 32 16.3 Overview of procedures 33 17 Request Val

17、idation procedure. 35 17.1 Introduction . 35 17.2 Procedure parameters 36 17.3 Procedure definition 36 18 Name Resolution procedure 38 18.1 Introduction . 38 18.2 Find DSE procedure parameters 38 18.3 Procedures . 39 19 Operation evaluation. 47 19.1 Modification procedure . 47 19.2 Single entry inte

18、rrogation procedure . 54 19.3 Multiple entry interrogation procedure 54 20 Continuation Reference procedures 66 20.1 Chaining strategy in the presence of shadowing . 66 20.2 Issuing chained subrequests to a remote DSA. 69 20.3 Procedures parameters 69 20.4 Definition of the Procedures 69 20.5 Abando

19、n procedure . 77 21 Results Merging procedure. 78 22 Procedures for distributed authentication . 78 22.1 Originator authentication. 79 22.2 Results authentication 80 SECTION 6 KNOWLEDGE ADMINISTRATION. 81 23 Knowledge administration overview 81 23.1 Maintenance of Knowledge References 81 23.2 Reques

20、ting cross reference 82 23.3 Knowledge inconsistencies 83 23.4 Knowledge References and contexts. 83 24 Hierarchical operational bindings. 84 24.1 Operational binding type characteristics . 84 24.2 Operational binding information object Class definition. 87 24.3 DSA procedures for hierarchical opera

21、tional binding management 87 24.4 Procedures for operations 91 24.5 Use of application contexts 91 ISO/IEC 9594-4:2001 (E) ISO/IEC 2001 All rights reserved vPage 25 Non-specific hierarchical operational binding 91 25.1 Operational binding type characteristics . 91 25.2 Operational binding informatio

22、n object class definition . 92 25.3 DSA procedures for non-specific hierarchical operational binding management . 93 25.4 Procedures for operations 94 25.5 Use of application contexts 94 Annex A ASN.1 for Distributed Operations . 95 Annex B Example of distributed name resolution 99 Annex C Distribut

23、ed use of authentication . 101 C.1 Summary . 101 C.2 Distributed protection model. 101 C.3 Signed Chained Operations . 102 C.4 Encrypted Chained Operations 103 C.5 Signed and Encrypted Distributed Operations. 106 Annex D Specification of hierarchical and non-specific hierarchical operational binding

24、 types 108 Annex E Knowledge maintenance example 110 Annex F Amendments and corrigenda 112 ISO/IEC 9594-4:2001 (E) vi ISO/IEC 2001 All rights reservedForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system

25、for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees colla

26、borate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards

27、 are drafted in accordance with the rules given in the ISO/IEC Directives, Part 3. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as

28、 an International Standard requires approval by at least 75 % of the national bodies casting a vote. Attention is drawn to the possibility that some of the elements of this part of ISO/IEC 9594 may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all

29、such patent rights. Users and implementors should note the existence of a “defect resolution” procedure in ISO/IEC JTC 1 to identify and correct errors in International Standards through the publication of Technical Corrigenda. Identical corrections are made to the corresponding ITU-T Recommendation

30、s through Corrigenda and may also be made in the form of Implementors Guides. Details of Technical Corrigenda to International Standards are available on the ISO website; published Technical Corrigenda can be obtained via the ISO webstore or from the ISO and IEC national bodies. Corrigenda and Imple

31、mentors Guides to ITU-T Recommendations can be obtained from the ITU-T website. ISO/IEC 9594-4 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 6, Telecommunications and information exchange between systems, in collaboration with ITU-T. The identical t

32、ext is published as ITU-T Rec. X.518. This fourth edition of ISO/IEC 9594-4 constitutes a technical revision of the third edition (ISO/IEC 9594-4:1998), which is provisionally retained in order to support implementations based on the third edition. This edition also incorporates Corrigendum 1:2002.

33、ISO/IEC 9594 consists of the following parts, under the general title Information technology Open Systems Interconnection The Directory: Part 1: Overview of concepts, models and services Part 2: Models Part 3: Abstract service definition Part 4: Procedures for distributed operation Part 5: Protocol

34、specifications Part 6: Selected attribute types Part 7: Selected object classes Part 8: Public-key and attribute certificate frameworks Part 9: Replication Part 10: Use of systems management for administration of the Directory Annexes A and D form a normative part of this part of ISO/IEC 9594. Annex

35、es B, C, E and F are for information only. ISO/IEC 9594-4:2001 (E) ISO/IEC 2001 All rights reserved viiIntroduction This Recommendation | International Standard part together with other Recommendations | International Standards, has been produced to facilitate the interconnection of information proc

36、essing systems to provide directory services. A set of such systems, together with the directory information that they hold, can be viewed as an integrated whole, called the Directory. The information held by the Directory, collectively known as the Directory Information Base (DIB), is typically use

37、d to facilitate communication between, with or about objects such as application entities, people, terminals and distribution lists. The Directory plays a significant role in Open Systems Interconnection, whose aim is to allow, with a minimum of technical agreement outside of the interconnection sta

38、ndards themselves, the interconnection of information processing systems: from different manufacturers; under different managements; of different levels of complexity; and of different ages. This Recommendation | International Standard specifies the procedures by which the distributed components of

39、the Directory interwork in order to provide a consistent service to its users. This fourth edition technically revises and enhances, but does not replace, the third edition of this Recommendation | International Standard. Implementations may still claim conformance to the third edition. However, at

40、some point, the third edition will not be supported (i.e. reported defects will no longer be resolved). It is recommended that implementations conform to this fourth edition as soon as possible. This fourth edition specifies version 1 and version 2 of the Directory protocols. The first and second ed

41、itions specified only version 1. Most of the services and protocols specified in this edition are designed to function under version 1. However, some enhanced services and protocols, e.g. signed errors, will not function unless all Directory entities involved in the operation have negotiated version

42、 2. Whichever version has been negotiated, differences between the services and between the protocols defined in the four editions, except for those specifically assigned to version 2, are accommodated using the rules of extensibility defined in this edition of ITU-T Rec. X.519 | ISO/IEC 9594-5. Ann

43、ex A, which is an integral part of this Recommendation | International Standard, provides the ASN.1 module for directory distributed operations. Annex B, which is not an integral part of this Recommendation | International Standard, describes an example of distributed name resolution. Annex C, which

44、 is not an integral part of this Recommendation | International Standard, describes authentication in the distributed operations environment. Annex D, which is an integral part of this Recommendation | International Standard, provides the definitions of the ASN.1 information object classes introduce

45、d in this Directory Specification. Annex E, which is not an integral part of this Recommendation | International Standard, illustrates knowledge maintenance. Annex F, which is not an integral part of this Recommendation | International Standard, lists the amendments and defect reports that have been

46、 incorporated to form this edition of this Recommendation | International Standard. ISO/IEC 9594-4:2001 (E) ITU-T Rec. X.518 (02/2001) 1 INTERNATIONAL STANDARD ITU-T RECOMMENDATION Information technology Open Systems Interconnection The Directory: Procedures for distributed operation SECTION 1 GENER

47、AL 1 Scope This Recommendation | International Standard specifies the behaviour of DSAs taking part in the distributed Directory application. The allowed behaviour has been designed so as to ensure a consistent service given a wide distribution of the DIB across many DSAs. The Directory is not inten

48、ded to be a general purpose database system, although it may be built on such systems. It is assumed that there is a considerably higher frequency of queries than of updates. 2 Normative references The following Recommendations and International Standards contain provisions which, through reference

49、in this text, constitute provisions of this Recommendation | International Standard. At the time of publication, the editions indicated were valid. All Recommendations and Standards are subject to revision, and parties to agreements based on this Recommendation | International Standard are encouraged to investigate the possibility of applying the most recent edition of the Recommendations and Standards listed below. Members of IEC and ISO maintain registers of currently valid Inte