1、Information technology Open Systems Interconnection The Directory Part 4: Procedures for distributed operation BS ISO/IEC 95944:2017 BSI Standards Publication WB11885_BSI_StandardCovs_2013_AW.indd 1 15/05/2013 15:06Information technology Open Systems Interconnection The Directory Part 4: Procedures
2、for distributed operation Technologies de linformation Interconnexion de systmes ouverts (OSI) L annuaire Partie 4: Procdures pour le fonctionnement rparti INTERNATIONAL STANDARD ISO/IEC 9594-4 Reference number ISO/IEC 9594-4:2017(E) Eighth edition 2017-05 ISO/IEC 2017 National foreword This British
3、 Standard is the UK implementation of ISO/IEC 95944:2017. It supersedes BS ISO/IEC 95944:2014, which is withdrawn. The UK participation in its preparation was entrusted to Technical Committee IST/6, Data communications. A list of organizations represented on this committee can be obtained on request
4、 to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2017 Published by BSI Standards Limited 2017 ISBN 978 0 580 96319 3 ICS 35.100.70 Compliance with a British
5、 Standard cannot confer immunity from legal obligations. This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 June 2017. Amendments/corrigenda issued since publication Date Text affected BRITISH STANDARD BS ISO/IEC 95944:2017Information technol
6、ogy Open Systems Interconnection The Directory Part 4: Procedures for distributed operation Technologies de linformation Interconnexion de systmes ouverts (OSI) L annuaire Partie 4: Procdures pour le fonctionnement rparti INTERNATIONAL STANDARD ISO/IEC 9594-4 Reference number ISO/IEC 9594-4:2017(E)
7、Eighth edition 2017-05 ISO/IEC 2017 BS ISO/IEC 95944:2017 ii ISO/IEC 2017 All rights reserved COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2017, Published in Switzerland All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any
8、 means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Ch. de Blandonnet 8 CP 401
9、 CH-1214 Vernier, Geneva, Switzerland Tel. +41 22 749 01 11 Fax +41 22 749 09 47 copyrightiso.org www.iso.org ISO/IEC 9594-4:2017(E) BS ISO/IEC 95944:2017 ii ISO/IEC 2017 All rights reserved COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2017, Published in Switzerland All rights reserved. Unless otherwise spe
10、cified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or
11、ISOs member body in the country of the requester. ISO copyright office Ch. de Blandonnet 8 CP 401 CH-1214 Vernier, Geneva, Switzerland Tel. +41 22 749 01 11 Fax +41 22 749 09 47 copyrightiso.org www.iso.org ISO/IEC 9594-4:2017(E)ISO/IEC 9594-4:2017(E) ISO/IEC 2017 All rights reserved ii-1 Foreword I
12、SO (the I nternation al O rgani z atio n fo r Standard iz ation) a nd I EC (the I nter nation al E lec trotechnical C om m i ssi o n ) f orm the s pe c i a l i z e d s ystem for worldwide s tandardiz at ion. N ational bo dies that a r e mem b ers of I SO o r IEC participate in t he d evelop ment o f
13、 Int e rna tion al S tandards through technic al committ ees e stablished by the resp ective o r g an ization to d eal w ith par ticular f i e l d s o f technical a ct iv it y . IS O a nd IE C technical committees c o l l ab or at e in fields of m utual interest. Other internati onal organiz a tio n
14、 s, g overn m ental and no ngovern mental, i n l i a i s o n w i th I S O a n d I E C , a l s o ta ke p art in the w ork. In the field of i nformatio n technolo g y, I SO an d IEC have e stab li shed a jo i n t technical committee, ISO /IEC J TC 1. The pr oce du r es used to d evelop this document a
15、 nd those i nt ended f or its f u r th e r m a i n te n a n c e a r e d e s c r ib e d in the I S O / I E C Dir e c ti ves, Part 1. In p articul ar the d ifferent a pproval criter ia needed f or the differ e nt types o f document s hould be noted. T his document w as d rafted in accordance w ith the
16、 e di to ri a l rul e s of the ISO /I EC Directives, Part 2 (see www.iso.org/directives ). A tt en ti o n is d rawn to t he possibility t hat some o f the el ements of t h i s d oc u men t m a y b e t h e s u bj ec t of p atent rights. ISO and IEC shall not be he l d r e sponsible f or identifying a
17、 ny or all such patent rig h ts. D e ta i l s o f a n y pa t e n t rig h ts i d e n tif i e d d u rin g th e d e v el opment o f th e document w ill be i n the Introduction and/or on t he ISO list of patent declarations rec e ived (see ww w.iso.org/patents ). Any t r ade na me used in this document
18、is information given for t h e co n v e n i e n c e o f us e r s a n d d o e s not constitu t e an endorsement. For an e xpl a nati on on t he meanin g of I SO s peci fic terms an d expr essions related to c on f or mi t y a ss es s me nt, as well a s informati o n about ISOs a d h e r e n c e to th
19、e W o r l d T r a d e O rgan izat ion (WTO) principles in the Technic a l B a r r i e r s to T r a d e (TBT) s e e the f o l lowing URL: www.iso.org/iso/foreword.html. This e ight h e dition c ancels a nd r eplaces t he s eventh e dition ( ISO/IEC 95944:2014), w hich has been technical ly revised. T
20、his d ocum ent was pr e p ared b y IS O/IEC J T C 1 , Information technology, SC 6, Telecommunications and information exchange between systems , i n c o ll a b o r a ti o n w i th I T U T . T he i d e n ti c a l te x t i s published as ITU T X.5 18 (10/ 20 16). A li st o f al l pa rt s in t he ISO/
21、I E C 9 5 94 s e rie s, publishe d unde r t h e g en eral ti t le Information technology Open Systems Interconnection The Directory , c a n be fou nd on t h e IS O w e bsite. BS ISO/IEC 95944:2017BS ISO/IEC 95944:2017 Rec. ITU-T X.518 (10/2016) iii CONTENTS Page SECTION 1 GENERAL . 1 1 Scope 1 2 Ref
22、erences 1 2.1 Normative references 1 2.2 Non-normative reference . 2 3 Definitions 2 3.1 Basic Directory definitions 2 3.2 Directory model definitions 2 3.3 DSA information model definitions 2 3.4 Abstract service definitions . 3 3.5 Protocol definitions . 3 3.6 Directory replication definitions . 3
23、 3.7 Distributed operation definitions . 3 4 Abbreviations . 5 5 Conventions 5 SECTION 2 OVERVIEW 7 6 Overview 7 SECTION 3 DISTRIBUTED DIRECTORY MODELS 8 7 Distributed Directory system model . 8 8 DSA interactions model . 9 8.1 Decomposition of a request . 9 8.2 Uni-chaining 9 8.3 Multi-chaining . 1
24、0 8.4 Referral 11 8.5 Mode determination 12 SECTION 4 DSA ABSTRACT SERVICE 13 9 Overview of DSA abstract service . 13 10 Information types . 13 10.1 Introduction . 13 10.2 Information types defined elsewhere 13 10.3 Chaining arguments 14 10.4 Chaining results . 17 10.5 Operation progress 17 10.6 Tra
25、ce information 18 10.7 Reference type . 18 10.8 Access point information 18 10.9 DIT bridge knowledge 19 10.10 Exclusions . 20 10.11 Continuation reference 20 11 Bind and Unbind 21 11.1 DSA Bind 21 11.2 DSA Unbind 22 12 Chained operations . 22 12.1 Chained operations 23 12.2 Chained Abandon operatio
26、n 23 12.3 Chained operations and protocol version 24 13 Chained errors 24 13.1 Introduction . 24 13.2 DSA referral 24 SECTION 5 DISTRIBUTED PROCEDURES. 25 BS ISO/IEC 95944:2017 iv Rec. ITU-T X.518 (10/2016) Page 14 Introduction 25 14.1 Scope and limits 25 14.2 Conformance . 25 14.3 Conceptual model
27、25 14.4 Individual and cooperative operation of DSAs . 25 14.5 Cooperative agreements between DSAs . 26 15 Distributed Directory behaviour . 26 15.1 Cooperative fulfilment of operations 26 15.2 Phases of operation processing 26 15.3 Managing Distributed Operations . 27 15.4 Loop handling . 28 15.5 O
28、ther considerations for distributed operation 29 15.6 Authentication of Distributed operations 30 16 The Operation Dispatcher . 31 16.1 General concepts . 31 16.2 Procedures of the Operation Dispatcher 36 16.3 Overview of procedures 37 17 Request Validation procedure 38 17.1 Introduction . 38 17.2 P
29、rocedure parameters 39 17.3 Procedure definition 40 18 Name Resolution procedure . 42 18.1 Introduction . 42 18.2 Find DSE procedure parameters 43 18.3 Procedures . 44 19 Operation evaluation 53 19.1 Modification procedures . 54 19.2 Single entry interrogation procedure . 61 19.3 Multiple entry inte
30、rrogation procedure . 61 20 Continuation Reference procedures 75 20.1 Chaining strategy in the presence of shadowing . 75 20.2 Issuing chained subrequests to a remote DSA or LDAP server 77 20.3 Procedures parameters 77 20.4 Definition of the procedures 78 20.5 Abandon procedures 87 20.6 DAP request
31、to LDAP request procedure . 89 20.7 LDAP result to DAP reply procedure . 93 21 Results Merging procedure . 95 22 Procedures for distributed authentication . 97 22.1 Requester authentication . 98 22.2 Results authentication . 98 SECTION 6 KNOWLEDGE ADMINISTRATION . 99 23 Knowledge administration over
32、view 99 23.1 Maintenance of knowledge references 99 23.2 Requesting cross reference 100 23.3 Knowledge inconsistencies . 101 24 Hierarchical operational bindings . 102 24.1 Operational binding type characteristics . 102 24.2 Operational binding information object Class definition 104 24.3 DSA proced
33、ures for hierarchical operational binding management 105 24.4 Procedures for operations 108 24.5 Use of application contexts . 109 BS ISO/IEC 95944:2017 iv Rec. ITU-T X.518 (10/2016) Page 14 Introduction 25 14.1 Scope and limits 25 14.2 Conformance . 25 14.3 Conceptual model 25 14.4 Individual and c
34、ooperative operation of DSAs . 25 14.5 Cooperative agreements between DSAs . 26 15 Distributed Directory behaviour . 26 15.1 Cooperative fulfilment of operations 26 15.2 Phases of operation processing 26 15.3 Managing Distributed Operations . 27 15.4 Loop handling . 28 15.5 Other considerations for
35、distributed operation 29 15.6 Authentication of Distributed operations 30 16 The Operation Dispatcher . 31 16.1 General concepts . 31 16.2 Procedures of the Operation Dispatcher 36 16.3 Overview of procedures 37 17 Request Validation procedure 38 17.1 Introduction . 38 17.2 Procedure parameters 39 1
36、7.3 Procedure definition 40 18 Name Resolution procedure . 42 18.1 Introduction . 42 18.2 Find DSE procedure parameters 43 18.3 Procedures . 44 19 Operation evaluation 53 19.1 Modification procedures . 54 19.2 Single entry interrogation procedure . 61 19.3 Multiple entry interrogation procedure . 61
37、 20 Continuation Reference procedures 75 20.1 Chaining strategy in the presence of shadowing . 75 20.2 Issuing chained subrequests to a remote DSA or LDAP server 77 20.3 Procedures parameters 77 20.4 Definition of the procedures 78 20.5 Abandon procedures 87 20.6 DAP request to LDAP request procedur
38、e . 89 20.7 LDAP result to DAP reply procedure . 93 21 Results Merging procedure . 95 22 Procedures for distributed authentication . 97 22.1 Requester authentication . 98 22.2 Results authentication . 98 SECTION 6 KNOWLEDGE ADMINISTRATION . 99 23 Knowledge administration overview 99 23.1 Maintenance
39、 of knowledge references 99 23.2 Requesting cross reference 100 23.3 Knowledge inconsistencies . 101 24 Hierarchical operational bindings . 102 24.1 Operational binding type characteristics . 102 24.2 Operational binding information object Class definition 104 24.3 DSA procedures for hierarchical op
40、erational binding management 105 24.4 Procedures for operations 108 24.5 Use of application contexts . 109 Rec. ITU-T X.518 (10/2016) v Page 25 Non-specific hierarchical operational binding 109 25.1 Operational binding type characteristics . 109 25.2 Operational binding information object class defi
41、nition . 110 25.3 DSA procedures for non-specific hierarchical operational binding management . 110 25.4 Procedures for operations 112 25.5 Use of application contexts . 112 Annex A ASN.1 for Distributed Operations . 113 Annex B Specification of hierarchical and non-specific hierarchical operational
42、 binding types. 117 Annex C Example of distributed name resolution 119 Annex D Distributed use of authentication . 121 D.1 Summary . 121 D.2 Distributed protection model . 121 D.3 Signed chained operations . 121 Annex E Knowledge maintenance example . 123 Annex F Amendments and corrigenda . 126 BS I
43、SO/IEC 95944:2017vi Rec. ITU-T X.518 (10/2016) Introduction This Recommendation | International Standard, together with other Recommendations | International Standards, have been produced to facilitate the interconnection of information processing systems to provide directory services. A set of such
44、 systems, together with the directory information that they hold, can be viewed as an integrated whole, called the Directory. The information held by the Directory, collectively known as the Directory information base (DIB), is typically used to facilitate communication between, with or about object
45、s such as application entities, people, terminals and distribution lists. The Directory plays a significant role in Open Systems Interconnection, whose aim is to allow, with a minimum of technical agreement outside of the interconnection standards themselves, the interconnection of information proce
46、ssing systems: from different manufacturers; under different managements; of different levels of complexity; and of different ages. This Recommendation | International Standard specifies the procedures by which the distributed components of the Directory interwork in order to provide a consistent se
47、rvice to its users. This Recommendation | International Standard provides the foundation frameworks upon which industry profiles can be defined by other standards groups and industry forums. Many of the features defined as optional in these frameworks may be mandated for use in certain environments
48、through profiles. This eighth edition technically revises and enhances the seventh edition of this Recommendation | International Standard. This eighth edition specifies versions 1 and 2 of the Directory protocols. The first and second editions specified only version 1. Most of the services and prot
49、ocols specified in this edition are designed to function under version 1. However, some enhanced services and protocols, e.g., signed errors, will not function unless all Directory entities involved in the operation have negotiated version 2. Whichever version has been negotiated, differences between the services and between the protocols defined in the eight editions, except for those specifically assigned to version 2, are accommodated using the rules of extensibility
