RFC 4104

Policy Core Extension Lightweight Directory Access Protocol Schema (PCELS)

📅 published June 2005, from ietf

Policy Core Extension LDAP Schema (PCELS) 🎀

bestie, this one is a standards track doc from June 2005 💅 It's from the Network Working Group and it's a Request for Comments, so it's an official Internet spec. Authors: M. Pana, Ed. (MetaSolv), A. Reyes (Computer Architecture, UPC), A. Barba and D. Moron (Technical University of Catalonia), and M. Brunner (NEC). It updates RFC 3703 and doesn't obsolete anything 👑 So if you're working with RFC 3703, this is its glow-up ✨

Status of This Memo ✨

okay so this is an Internet standards track protocol for the Internet community, and the authors are literally asking everyone to discuss it and send suggestions for improvements 🫶 For the current standardization state and status, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited, so share it with everyone 🌸

Copyright (C) The Internet Society (2005). That's the legal bit 🙈

Abstract 🦋

so this doc changes and extends the Policy Core LDAP Schema (RFC 3703) 💖 The extensions are built on the model extensions from the Policy Core Information Model (PCIM) Extensions (RFC 3460). The changes are new LDAP object classes and attribute types.

Some schema items re-implement existing concepts, but with the new meanings RFC 3460 brought in. The other schema items are brand new concepts that RFC 3703 never covered 🔥 And yes, this document updates RFC 3703 💅

Table of Contents 📚

1. Introduction ....................................................3
   1.1. Specification of Requirements ..............................3
2. Relationship to Other Policy Framework Documents ................3
3. Inheritance Hierarchy for PCELS .................................4
4. General Discussion of Mapping the Policy Core
   Information Model ...............................................8
   4.1. Summary of Class Mappings ..................................8
   4.2. Summary of Association Mappings ...........................11
   4.3. Summary of Changes since PCLS .............................13
   4.4. Relationship to PCLS Classes ..............................15
   4.5. Impact on Existing Implementations of the Policy
        Core LDAP Schema ..........................................16
   4.6. The Association of PolicyVariable and PolicyValues ........16
   4.7. The Aggregation of PolicyRules and PolicyGroups in
        PolicySets ................................................17
   4.8. The Aggregation of Actions/Conditions in PolicyRules and
        CompoundActions/CompoundConditions ........................20
5. Class Definitions ..............................................25
   5.1. The Abstract Class pcelsPolicySet .........................26
   5.2. The Structural Class pcelsPolicySetAssociation ............29
   5.3. The Three Policy Group Classes ............................30
   5.4. The Three Policy Rule Classes .............................31
   5.5. The Structural Class pcelsConditionAssociation ............36
   5.6. The Structural Class pcelsActionAssociation ...............37
   5.7. The Auxiliary Class pcelsSimpleConditionAuxClass ..........38
   5.8. The Auxiliary Class pcelsCompoundConditionAuxClass ........39
   5.9. The Auxiliary Class pcelsCompoundFilterConditionAuxClass ..40
   5.10. The Auxiliary Class pcelsSimpleActionAuxClass ............41
   5.11. The Auxiliary Class pcelsCompoundActionAuxClass ..........42
   5.12. The Abstract Class pcelsVariable .........................43
   5.13. The Auxiliary Class pcelsExplicitVariableAuxClass ........44
   5.14. The Auxiliary Class pcelsImplicitVariableAuxClass ........46
   5.15. The Subclasses of pcelsImplicitVariableAuxClass ..........47
   5.16. The Auxiliary Class pcelsValueAuxClass. ..................54
   5.17. The Subclasses of pcelsValueAuxClass. ....................55
   5.18. The Three Reusable Policy Container Classes ..............60
   5.19. The Structural Class pcelsRoleCollection. ................62
   5.20. The Abstract Class pcelsFilterEntryBase ..................64
   5.21. The Structural Class pcelsIPHeadersFilter ................65
   5.22. The Structural Class pcels8021Filter .....................73
   5.23. The Auxiliary Class pcelsFilterListAuxClass ..............77
   5.24. The Auxiliary Class pcelsVendorVariableAuxClass ..........79
   5.25. The Auxiliary Class pcelsVendorValueAuxClass .............80
6. Security Considerations ........................................81
7. IANA Considerations ............................................82
   7.1. Object Identifiers ........................................82
   7.2. Object Identifier Descriptors .............................82
8. Acknowledgements ...............................................85
9. Normative References ...........................................85
10. Informative References ........................................86

1. Introduction ✨

this doc is the main event 🧚 It makes a bunch of changes and extensions to the Policy Core LDAP Schema [PCLS], based on the model extensions from the Policy Core Information Model (PCIM) Extensions [PCIM_EXT]. The changes are new LDAP object classes and attribute types [LDAP]. Some schema items re-implement existing concepts using the new semantics from [PCIM_EXT], and the others are brand new concepts that [PCLS] didn't cover. And once again, this document updates RFC 3703 [PCLS] 💅

also, on top of what [PCIM_EXT] already defines, this doc adds two new classes: pcelsVendorVariableAuxClass and pcelsVendorValueAuxClass 🌈 They're a standard extension mechanism for vendor-specific policy variables and policy values that haven't been specifically modeled yet. Iconic for flexibility, no cap.

in this doc, "PCELS" (Policy Core Extension LDAP Schema) is shorthand for the LDAP object class and attribute type definitions, plus the related recommendations in here 🦋

1.1. Specification of Requirements

here's the key word part 🔑 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [KEYWORDS]. So when you see those words in caps, that's the official RFC 2119 meaning, periodt 💀

2. Relationship to Other Policy Framework Documents 🌸

so this doc has an LDAP schema mapping for the classes defined in the "Policy Core Information Model (PCIM) Extensions" [PCIM_EXT] 💖 The LDAP schema here extends the "Policy Core Lightweight Directory Access Protocol (LDAP) Schema" [PCLS]. That one maps the "Policy Core Information Model -- Version 1 Specification" [PCIM] to an LDAP schema.

these three docs ([PCIM], [PCIM_EXT] and [PCLS]) are prerequisites, so read them first or you'll be lost 😭

other docs may come later and map the same model to other storage or transport technologies 🧚

3. Inheritance Hierarchy for PCELS ✨

okay so first things first, every object class and attribute type name in this doc starts with pcels 🎀. that prefix is how you spot our stuff at a glance, bestie 💅

the diagram below shows the whole combined class hierarchy for the LDAP object classes from all the docs involved:

  • the pcels class names are defined in this document.
  • the pcim class names are defined in [PCLS].
  • the dlm1 class names are defined in [CIM_LDAP].
  • the class named top is defined in [LDAP_SCHEMA].

ngl the tree is giving main character energy 🦋. almost all the new object classes (everything except pcelsVendorVariableAuxClass and pcelsVendorValueAuxClass) are mapped from concepts that [PCIM_EXT] defines or modifies. the two vendor classes are the exception: they're not mapped from [PCIM_EXT] because they represent concepts that were introduced right here in this document 🌸

   top
   |
   +---dlm1ManagedElement (abstract)
   |   |
   |   +---pcimPolicy (abstract)
   |   |   |
   |   |   +---pcelsPolicySet (abstract new)
   |   |   |   |
   |   |   |   +---pcelsGroup (abstract new)
   |   |   |   |   |
   |   |   |   |   +---pcelsGroupAuxClass (auxiliary new)
   |   |   |   |   |
   |   |   |   |   +---pcelsGroupInstance (structural new)
   |   |   |   |
   |   |   |   +---pcelsRule (abstract new)
   |   |   |       |
   |   |   |       +---pcelsRuleAuxClass (auxiliary new)
   |   |   |       |
   |   |   |       +---pcelsRuleInstance (structural new)
   |   |   |
   |   |   +---pcimGroup (abstract)
   |   |   |   |
   |   |   |   +---pcimGroupAuxClass (auxiliary)
   |   |   |   |
   |   |   |   +---pcimGroupInstance (structural)
   |   |   |
   |   |   +---pcimRule (abstract)
   |   |   |   |
   |   |   |   +---pcimRuleAuxClass (auxiliary)
   |   |   |   |
   |   |   |   +---pcimRuleInstance (structural)
   |   |   |
   |   |   +---pcimRuleConditionAssociation (structural)
   |   |   |   |
   |   |   |   +---pcelsConditionAssociation (structural new)
   |   |   |
   |   |   +---pcimRuleValidityAssociation (structural)
   |   |   |
   |   |   +---pcimRuleActionAssociation (structural)
   |   |   |   |
   |   |   |   +---pcelsActionAssociation (structural new)
   |   |   |
   |   |   +---pcelsPolicySetAssociation (structural new)
   |   |   |
   |   |   +---pcimPolicyInstance (structural)
   |   |   |
   |   |   +---pcimElementAuxClass (auxiliary)
   |   |   |
   |   |   +---pcelsRoleCollection (structural new)
   |   |   |
   |   |   +---pcelsFilterEntryBase (abstract new)
   |   |       |
   |   |       +---pcelsIPHeadersFilter (structural new)
   |   |       |
   |   |       +---pcels8021Filter (structural new)
   |   |
   |   +---dlm1ManagedSystemElement (abstract)
   |       |
   |       +---dlm1LogicalElement (abstract)
   |           |
   |           +---dlm1System (abstract)
   |               |
   |               +---dlm1AdminDomain (abstract)
   |                   |
   |                   +---pcimRepository (abstract)
   |                       |
   |                       +---pcimRepositoryAuxClass (auxiliary)
   |                       |
   |                       +---pcimRepositoryInstance (structural)
   |                       |
   |                       +---pcelsReusableContainer (abstract new)
   |                           |
   |                           +---pcelsReusableContainerAuxClass
   |                           |   (auxiliary new)
   |                           |
   |                           +---pcelsReusableContainerInstance
   |                               (structural new)
   |
   +---pcimConditionAuxClass (auxiliary)
   |   |
   |   +---pcimTPCAuxClass (auxiliary)
   |   |
   |   +---pcimConditionVendorAuxClass (auxiliary)
   |   |
   |   +---pcelsSimpleConditionAuxClass (auxiliary new)
   |   |
   |   +---pcelsCompoundConditionAuxClass (auxiliary new)
   |   |   |
   |   |   +---pcelsCompoundFilterConditionAuxClass (auxiliary new)
   |   |
   |   +---pcelsFilterListAuxClass (auxiliary new)
   |
   +---pcimActionAuxClass (auxiliary)
   |   |
   |   +---pcimActionVendorAuxClass (auxiliary)
   |   |
   |   +---pcelsSimpleActionAuxClass (auxiliary new)
   |   |
   |   +---pcelsCompoundActionAuxClass (auxiliary new)
   |
   +---pcelsVariable (abstract new)
   |   |
   |   +---pcelsVendorVariableAuxClass (auxiliary new)
   |   |
   |   +---pcelsExplicitVariableAuxClass (auxiliary new)
   |   |
   |   +---pcelsImplicitVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsSourceIPv4VariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsSourceIPv6VariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsDestinationIPv4VariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsDestinationIPv6VariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsSourcePortVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsDestinationPortVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsIPProtocolVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsIPVersionVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsIPToSVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsDSCPVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsFlowIdVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsSourceMACVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsDestinationMACVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsVLANVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsCoSVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsEthertypeVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsSourceSAPVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsDestinationSAPVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsSNAPOUIVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsSNAPTypeVariableAuxClass (auxiliary new)
   |       |
   |       +---pcelsFlowDirectionVariableAuxClass (auxiliary new)
   |
   +---pcelsValueAuxClass (auxiliary new)
   |   |
   |   +---pcelsVendorValueAuxClass (auxiliary new)
   |   |
   |   +---pcelsIPv4AddrValueAuxClass (auxiliary new)
   |   |
   |   +---pcelsIPv6AddrValueAuxClass (auxiliary new)
   |   |
   |   +---pcelsMACAddrValueAuxClass (auxiliary new)
   |   |
   |   +---pcelsStringValueAuxClass (auxiliary new)
   |   |
   |   +---pcelsBitStringValueAuxClass (auxiliary new)
   |   |
   |   +---pcelsIntegerValueAuxClass (auxiliary new)
   |   |
   |   +---pcelsBooleanValueAuxClass (auxiliary new)
   |
   +---pcimSubtreesPtrAuxClass (auxiliary)
   |
   +---pcimGroupContainmentAuxClass (auxiliary)
   |
   +---pcimRuleContainmentAuxClass (auxiliary)

         Figure 1.  LDAP Class Inheritance Hierarchy for PCELS

4. General Discussion of Mapping the Policy Core Information Model Extensions to LDAP 🧚

so the object classes in this doc have some optimizations baked in for a directory that uses LDAP as its access protocol 💖. one example is auxiliary class attachment: LDAP entries get auxiliary classes stuck on them to realize some of the associations from the information model. for instance, when a specific SimplePolicyCondition is aggregated into a reusable PolicyRule [PCIM_EXT], that can be realized by attaching a pcelsSimpleConditionAuxClass to a pcelsRuleInstance entry 🫶

heads up though: other data stores might need to implement those associations differently 👀

4.1. Summary of Class Mappings

the classes and their properties from the information model [PCIM_EXT] map directly to LDAP object classes and attribute types ✨. we go through the details of each mapping case by case in section 5 🔥

+----------------------------------------------------------------------+
| Information Model (PCIM_EXT)  | LDAP Class(es)                       |
+----------------------------------------------------------------------+
| PolicySet                     | pcelsPolicySet                       |
+----------------------------------------------------------------------+
| PolicyGroup                   | pcelsGroup                           |
|                               | pcelsGroupAuxClass                   |
|                               | pcelsGroupInstance                   |
+----------------------------------------------------------------------+
| PolicyRule                    | pcelsRule                            |
|                               | pcelsRuleAuxClass                    |
|                               | pcelsRuleInstance                    |
+----------------------------------------------------------------------+
| SimplePolicyCondition         | pcelsSimpleConditionAuxClass         |
+----------------------------------------------------------------------+
| CompoundPolicyCondition       | pcelsCompoundConditionAuxClass       |
+----------------------------------------------------------------------+
| CompoundFilterCondition       | pcelsCompoundFilterConditionAuxClass |
+----------------------------------------------------------------------+
| SimplePolicyAction            | pcelsSimpleActionAuxClass            |
+----------------------------------------------------------------------+
| CompoundPolicyAction          | pcelsCompoundActionAuxClass          |
+----------------------------------------------------------------------+
| PolicyVariable                | pcelsVariable                        |
+----------------------------------------------------------------------+
| --------------                | pcelsVendorVariableAuxClass          |
+-------------------------------+--------------------------------------+
| PolicyExplicitVariable        | pcelsExplicitVariableAuxClass        |
+----------------------------------------------------------------------+
| PolicyImplicitVariable        | pcelsImplicitVariableAuxClass        |
+----------------------------------------------------------------------+
| PolicySourceIPv4Variable      | pcelsSourceIPv4VariableAuxClass      |
+----------------------------------------------------------------------+
| PolicySourceIPv6Variable      | pcelsSourceIPv6VariableAuxClass      |
+----------------------------------------------------------------------+
| PolicyDestinationIPv4Variable | pcelsDestinationIPv4VariableAuxClass |
+----------------------------------------------------------------------+
| PolicyDestinationIPv6Variable | pcelsDestinationIPv6VariableAuxClass |
+----------------------------------------------------------------------+
| PolicySourcePortVariable      | pcelsSourcePortVariableAuxClass      |
+----------------------------------------------------------------------+
| PolicyDestinationPortVariable | pcelsDestinationPortVariableAuxClass |
+----------------------------------------------------------------------+
| PolicyIPProtocolVariable      | pcelsIPProtocolVariableAuxClass      |
+----------------------------------------------------------------------+
| PolicyIPVersionVariable       | pcelsIPVersionVariableAuxClass       |
+----------------------------------------------------------------------+
| PolicyIPToSVariable           | pcelsIPToSVariableAuxClass           |
+----------------------------------------------------------------------+
| PolicyDSCPVariable            | pcelsDSCPVariableAuxClass            |
+----------------------------------------------------------------------+
| PolicyFlowIDVariable          | pcelsFlowIDVariableAuxClass          |
+----------------------------------------------------------------------+
| PolicySourceMACVariable       | pcelsSourceMACVariableAuxClass       |
+----------------------------------------------------------------------+
| PolicyDestinationMACVariable  | pcelsDestinationMACVariableAuxClass  |
+----------------------------------------------------------------------+
| PolicyVLANVariable            | pcelsVLANVariableAuxClass            |
+----------------------------------------------------------------------+
| PolicyCoSVariable             | pcelsCoSVariableAuxClass             |
+----------------------------------------------------------------------+
| PolicyEthertypeVariable       | pcelsEthertypeVariableAuxClass       |
+----------------------------------------------------------------------+
| PolicySourceSAPVariable       | pcelsSourceSAPVariableAuxClass       |
+----------------------------------------------------------------------+
| PolicyDestinationSAPVariable  | pcelsDestinationSAPVariableAuxClass  |
+----------------------------------------------------------------------+
| PolicySNAPOUIVariable         | pcelsSNAPOUIVariableAuxClass         |
+----------------------------------------------------------------------+
| PolicySNAPTypeVariable        | pcelsSNAPTypeVariableAuxClass        |
+----------------------------------------------------------------------+
| PolicyFlowDirectionVariable   | pcelsFlowDirectionVariableAuxClass   |
+----------------------------------------------------------------------+
| PolicyValue                   | pcelsValueAuxClass                   |
+----------------------------------------------------------------------+
| -------------                 | pcelsVendorValueAuxClass             |
+-------------------------------+--------------------------------------+
| PolicyIPv4AddrValue           | pcelsIPv4AddrValueAuxClass           |
+----------------------------------------------------------------------+
| PolicyIPv6AddrValue           | pcelsIPv6AddrValueAuxClass           |
+----------------------------------------------------------------------+
| PolicyMACAddrValue            | pcelsMACAddrValueAuxClass            |
+----------------------------------------------------------------------+
| PolicyStringValue             | pcelsStringValueAuxClass             |
+----------------------------------------------------------------------+
| PolicyBitStringValue          | pcelsBitStringValueAuxClass          |
+----------------------------------------------------------------------+
| PolicyIntegerValue            | pcelsIntegerValueAuxClass            |
+----------------------------------------------------------------------+
| PolicyBooleanValue            | pcelsBooleanValueAuxClass            |
+----------------------------------------------------------------------+
| PolicyRoleCollection          | pcelsRoleCollection                  |
+----------------------------------------------------------------------+
| ReusablePolicyContainer       | pcelsReusableContainer               |
|                               | pcelsReusableContainerAuxClass       |
|                               | pcelsReusableContainerInstance       |
+----------------------------------------------------------------------+
| FilterEntryBase               | pcelsFilterEntryBase                 |
+----------------------------------------------------------------------+
| IPHeadersFilter               | pcelsIPHeadersFilter                 |
+----------------------------------------------------------------------+
| 8021Filter                    | pcels8021Filter                      |
+----------------------------------------------------------------------+
| FilterList                    | pcelsFilterListAuxClass              |
+----------------------------------------------------------------------+

Figure 2. Mapping of Information Model Extension Classes to LDAP ✨

The pcelsVendorVariableAuxClass and pcelsVendorValueAuxClass classes are not mapped from [PCIM_EXT]. 🎀 These classes are introduced in this document as a brand new extension mechanism for vendor-specific policy variables and values that haven't been specifically modeled yet. 💅 Just like any other schema elements defined in this document or in [PCLS], a particular submodel schema generally won't need to use vendor specific variable and value classes. Submodel schemas SHOULD apply the recommendations of section 5.10 of [PCIM_EXT] with regards to the supported and unsupported elements. 🫶

4.2. Summary of Association Mappings 🦋

Okay so the associations in the information model map to one or more of these options:

  1. Attributes that reference DNs (Distinguished Names)
  2. Directory Information Tree (DIT) containment (i.e., superior-subordinate relationships) in LDAP
  3. Auxiliary class attachment
  4. Association object classes and attributes that reference DNs

The details of this mapping get discussed case by case in section 5. 🧚

+----------------------------------------------------------------------+
| Information Model Association    | LDAP Attribute/Class              |
+----------------------------------------------------------------------+
| PolicySetComponent               | pcelsPolicySetComponentList in    |
|                                  | pcelsPolicySet and                |
|                                  | pcelsPolicySetDN in               |
|                                  | pcelsPolicySetAsociation          |
+----------------------------------------------------------------------+
| PolicySetInSystem                | DIT Containment and               |
|                                  | pcelsPolicySetDN in               |
|                                  | pcelsPolicySetAsociation          |
+----------------------------------------------------------------------+
| PolicyGroupInSystem              | DIT Containment and               |
|                                  | pcelsPolicySetDN in               |
|                                  | pcelsPolicySetAsociation          |
+----------------------------------------------------------------------+
| PolicyRuleInSystem               | DIT Containment and               |
|                                  | pcelsPolicySetDN in               |
|                                  | pcelsPolicySetAsociation          |
+----------------------------------------------------------------------+
| PolicyConditionStructure         | pcimConditionDN in                |
|                                  | pcelsConditionAssociation         |
+----------------------------------------------------------------------+
| PolicyConditionInPolicyRule      | pcelsConditionList in             |
|                                  | pcelsRule and                     |
|                                  | pcimConditionDN in                |
|                                  | pcelsConditionAssociation         |
+----------------------------------------------------------------------+
| PolicyConditionInPolicyCondition | pcelsConditionList in             |
|                                  | pcelsCompoundConditionAuxClass    |
|                                  | and pcimConditionDN in            |
|                                  | pcelsConditionAssociation         |
+----------------------------------------------------------------------+
| PolicyActionStructure            | pcimActionDN in                   |
|                                  | pcelsActionAssociation            |
+----------------------------------------------------------------------+
| PolicyActionInPolicyRule         | pcelsActionList in                |
|                                  | pcelsRule and                     |
|                                  | pcimActionDN in                   |
|                                  | pcelsActionAssociation            |
+----------------------------------------------------------------------+
| PolicyActionInPolicyAction       | pcelsActionList in                |
|                                  | pcelsCompoundActionAuxClass       |
|                                  | and pcimActionDN in               |
|                                  | pcelsActionAssociation            |
+----------------------------------------------------------------------+
| PolicyVariableInSimplePolicy     | pcelsVariableDN in                |
| Condition                        | pcelsSimpleConditionAuxClass      |
+----------------------------------------------------------------------+
| PolicyValueInSimplePolicy        | pcelsValueDN in                   |
| Condition                        | pcelsSimpleConditionAuxClass      |
+----------------------------------------------------------------------+
| PolicyVariableInSimplePolicy     | pcelsVariableDN in                |
| Action                           | pcelsSimpleActionAuxClass         |
+----------------------------------------------------------------------+
| PolicyValueInSimplePolicyAction  | pcelsValueDN in                   |
|                                  | pcelsSimpleActionAuxClass         |
+----------------------------------------------------------------------+
| ReusablePolicy                   | DIT containment                   |
+----------------------------------------------------------------------+
| ExpectedPolicyValuesForVariable  | pcelsExpectedValueList in         |
|                                  | pcelsVariable                     |
+----------------------------------------------------------------------+
| ContainedDomain                  | DIT containment or                |
|                                  | pcelsReusableContainerList in     |
|                                  | pcelsReusableContainer            |
+----------------------------------------------------------------------+
| EntriesInFilterList              | pcelsFilterEntryList in           |
|                                  | pcelsFilterListAuxClass           |
+----------------------------------------------------------------------+
| ElementInPolicyRoleCollection    | DIT containment or                |
|                                  | pcelsElementList in               |
|                                  | pcelsRoleCollection               |
+----------------------------------------------------------------------+
| PolicyRoleCollectionInSystem     | DIT Containment                   |
+----------------------------------------------------------------------+

Figure 3. Mapping of Information Model Extension Associations to LDAP 🌈

Two [PCIM_EXT] associations get mapped to DIT containment, and here's why:

  • PolicyRoleCollectionInSystem is a weak association, and weak associations map really well to DIT containment [CIM_LDAP] (without being limited to this mapping). 🍓 With no additional constraints, DIT containment is chosen here as the optimal association mapping. 👑
  • ReusablePolicy is mapped to DIT containment for scalability reasons. 🔥 It's expected that applications will associate a large number of policy instances to a ReusablePolicyContainer, and DIT containment is a type of association that scales super well. 😭✨

4.3. Summary of Changes since PCLS 🎀

okay so this is the highlight reel of everything new compared to [PCLS] ✨ let's gooo

  1. the whole idea of a set of policies is new 🫶 it shows up through two brand-new object classes, pcelsPolicySet and pcelsPolicySetAssociation. together they let you bundle policies (rules and/or groups) and rank them against each other. the attribute pcelsPriority is what pcelsPolicySetAssociation instances use to say how a policy ranks against the others in the same set, and applications can use it to order the bundled policies however they like 💅 this is a new aggregation mechanism, and it's an alternative to the one [PCLS] already had (the one that defines pcimRuleContainmentAuxClass and/or pcimGroupContainmentAuxClass for attaching components to a pcimGroup).
  2. the attribute pcimRoles from [PCLS] is reused here by the pcelsPolicySet class, so role based policy selection now stretches across all the subclasses of pcelsPolicySet 🦋
  3. a new attribute, pcelsDecisionStrategy, lands on the pcelsPolicySet class as a mapping from the decision mechanism 🧚
  4. a new class, pcelsGroup (with two subclasses), brings in the updated semantics of the PolicyGroup, following [PCIM_EXT] 🌸 it inherits the ability from its superclass pcelsPolicySet to aggregate other policy rules or groups, with relative priority.
  5. a new class, pcelsRule (also with two subclasses), brings in the updated semantics of the PolicyRule, following [PCIM_EXT] 👑 it has no absolute priority attribute. instead, instances of non-abstract subclasses of pcelsRule can be prioritized relative to each other within a System (that behaviour is inherited from its superclass, pcelsPolicySet). pcelsRule also inherits the ability to aggregate other policy rules or groups from pcelsPolicySet, so you can build nested rule structures of pretty much any complexity 🍓
  6. a new attribute, pcelsExecutionStrategy, is added to the pcelsRule and pcelsCompoundActionAuxClass classes. it lets you specify the expected behaviour when a rule or a compound action aggregates multiple actions 🔥
  7. Compound Conditions: the pcelsCompoundConditionAuxClass class is added to map the CompoundPolicyCondition class. a new class, pcelsConditionAssociation, is used to aggregate policy conditions in a pcelsCompoundConditionAuxClass, and the same class also aggregates policy conditions in a pcelsRule 💖
  8. Compound Actions: the pcelsCompoundActionAuxClass class is added to map the CompoundPolicyAction class. a new class, pcelsActionAssociation, is used to aggregate policy actions in a pcelsCompoundActionAuxClass, and the same class also aggregates policy actions in a pcelsRule 🌈
  9. Simple Conditions, Simple Actions, Variables and Values: the simple condition, simple action, variable and value classes from [PCIM_EXT] get mapped directly to LDAP object classes. those are pcelsSimpleConditionAuxClass, pcelsSimpleActionAuxClass, pcelsVariable and its subclasses, and pcelsValueAuxClass and its subclasses ✨
  10. there's a general extension mechanism for representing policy variables and values that haven't been specifically modelled. it's meant for vendor-specific extensions 🧚
  11. Reusable Policy Repository: a new class (with two subclasses), pcelsReusableContainer, is created as a subclass of pcimRepository. it keeps compatibility with older [PCLS] implementations, and it also acknowledges the intent of [PCIM_EXT] to avoid confusion with the Policy Framework component called Policy Repository 🙈 the new class enables many-to-many associations between reusable policy containers.
  12. the ReusablePolicy association from [PCIM_EXT] is realized through subordination to an instance of a non-abstract subclass of pcelsReusableContainer. so reusable policy components (groups, rules, conditions, actions, variables and values) can be defined as stand-alone entries, or as stand-alone groups of related entries that are subordinated (DIT contained) to a pcelsReusableContainer 🦋
  13. device level filter classes are added to the schema 💜
  14. the pcelsRoleCollection class is added to the schema, so policy roles can be associated with resources represented as LDAP entries 🫶

4.4. Relationship to PCLS Classes 💅

so a bunch of [PCLS] classes get used in this document to derive other classes. if a PCELS application needs a feature provided by any of the derived classes, then the [PCLS] class MUST also be supported by PCELS implementations. the ones in this group are:

pcimPolicy
pcimRuleConditionAssociation
pcimRuleActionAssociation
pcimConditionAuxClass
pcimActionAuxClass
pcimRepository

the other [PCLS] classes aren't derived to, and they aren't superseded by anything in this document either. if a PCELS application needs a feature from any of these, the [PCLS] class SHOULD be used. they are:

pcimRuleValidityAssociation
pcimTPCAuxClass
pcimConditionVendorAuxClass
pcimActionVendorAuxClass
pcimPolicyInstance
pcimElementAuxClass
pcimSubtreesPtrAuxClass

some of the classes in this document cover concepts that supersede what similar [PCLS] classes did. PCELS implementations MAY support those [PCLS] classes, which are:

pcimGroup and its subclasses
pcimRule and its subclasses
pcimGroupContainmentAuxClass
pcimRuleContainmentAuxClass
the subclasses of pcimRepository

4.5. Impact on Existing Implementations of the Policy Core LDAP Schema 🌸

in general, PCELS is meant to extend what the Policy Core LDAP Schema already does. for the most part, compatibility with [PCLS] is kept. the few spots where it can't be kept, because of fundamental changes brought in by [PCIM_EXT], are defined here as alternatives to the original implementation.

PCELS doesn't obsolete or deprecate anything [PCLS] implements. the new LDAP schema items are defined in a way that avoids interfering with the normal operation of a reasonably well-executed [PCLS] implementation, as much as possible. the goal is to allow at least a harmless coexistence of the two models in the same data repository 🫶

that said, it should be noted that PCELS introduces the following changes that may have an impact on some [PCLS] implementations:

  1. some attributes that were originally only used by pcimRule or pcimGroup are now also used by classes [PCLS] implementations don't know about (pcelsPolicySet, pcelsRule and pcelsGroup). in particular, pcimRoles is also used by pcelsPolicySet for role based policy selection 🦋
  2. condition and action association classes that were originally used only by pcimRule are now used (through subclasses) by pcelsRule as well 💖
  3. pcimRepository containers may include entries of types that [PCLS] implementations don't know about 🙈

when there's a choice, PCELS implementations SHOULD support the new schema, and they MAY also support the one defined by [PCLS]. for example, if PolicyRule support is required, an implementation SHOULD be able to read or read-write (as applicable) pcelsRule entries. the same implementation MAY be able to read or read-write pcimRule 🌈

4.6. The Association of PolicyVariable and PolicyValues to PolicySimpleCondition and PolicySimpleAction 🧚

okay so a PolicySimpleCondition, and a PolicySimpleAction too, each include one PolicyValue and one PolicyVariable. each of those can be either attached or referenced by a DN ✨

attaching them makes the PolicyCondition and PolicyAction definitions compact, which means they can be provisioned and retrieved from the repository efficiently 💅 referenced PolicyVariables and PolicyValues instances, on the other hand, can be reused when building multiple policies, and they let you partition the data and policy definitions administratively 👑

4.7. The Aggregation of PolicyRules and PolicyGroups in PolicySets 🎀

okay so in [PCIM_EXT], the two aggregations PolicyGroupInPolicyGroup and PolicyRuleInPolicyGroup get merged into one single aggregation called PolicySetComponent 💅. this is giving new possibilities for reusability, especially with the association between a policy and the ReusablePolicyContainer ✨. these aggregations also bring new semantics for running one PolicyRule inside the scope of another PolicyRule 🤯.

since PolicySet is defined in [PCIM_EXT], this document maps it to a brand-new class called pcelsPolicySet 🧚. that gives you an abstraction for a set of policy rules or groups. the PolicySetComponent aggregation from [PCIM_EXT] is mapped to the multi-value attribute pcelsPolicySetList in the pcelsPolicySet class, and to the attribute pcelsPolicySetDN in the pcelsPolicySetAssociation class. these attributes point at the nested rules and groups 🫶.

there are two ways to store a rule or group that's nested inside another rule or group 🌈. way one is to define the nested rule/group as specific to the nesting rule/group. way two is to define the nested rules/groups as reusable 🦋.

First case: Specific nested sets (rules/groups). 🍓

                   +----------+
                   |Rule/Group|
                   |          |
             +-----|-        -|-----+
             |     +----------+     |
             |       *      *       |
             |       *      *       |
             |    ****      ****    |
             |    *            *    |
             v    *            *    v
           +-----------+   +-----------+
           | SA1+Set1  |   | SA2+Set2  |
           +-----------+   +-----------+

          +------------------------------+
          |LEGEND:                       |
          |  ***** DIT containment       |
          |    +   auxiliary attachment  |
          |  ----> DN reference          |
          +------------------------------+

#: Number.
Set#: pcelsRuleAuxClass or pcelsGroupAuxClass auxiliary class.
SA#: pcelsPolicySetAssocation structural class.

Figure 4. Policy Set with Specific Components

the nesting pcelsPolicySet refers to instances of pcelsPolicySetAssociation using the attribute pcelsPolicySetList 🎯. these structural association classes are subordinated (DIT contained) to an instance of a non-abstract subclass of pcelsPolicySet, and they represent the association between the PolicySet and its nested rules/groups 💜. the nested instances of auxiliary subclasses of pcelsPolicySet get attached to the association entries 🌸.

Second case: Reusable nested sets (rules/groups). 🔥

         +----------+             +-------------+
         |Rule/Group|             | ContainerX  |
       +-|-        -|--+          |             |
       | +----------+  |          +-------------+
       |   *      *    |             *        *
       | ***      **** |             *        *
       | *           * v             *        *
       | *          +---+            *        *
       | *          |SA2|         +-------+   *
       v *          |  -|-------->|S1+Set2|   *
      +---+         +---+         +-------+   *
      |SA1|                               +-------+
      |  -|------------------------------>|S2+Set3|
      +---+                               +-------+

             +------------------------------+
             |LEGEND:                       |
             |  ***** DIT containment       |
             |    +   auxiliary attachment  |
             |  ----> DN reference          |
             +------------------------------+

Set#: pcelsRuleAuxClass or pcelsGroupAuxClass auxiliary class.
SA#: PolicySetAssocation structural class.
S#: structural class.

Figure 5. Policy Set with Reusable Components

same deal here: the nesting pcelsPolicySet refers to instances of pcelsPolicySetAssociation using the attribute pcelsPolicySetList 🦢. those structural association classes are subordinated (DIT contained) to an instance of a non-abstract subclass of pcelsPolicySet, and they represent the association between the PolicySet and its nested rules/groups 🎀. the trick is that the reusable rules/groups get instantiated as auxiliary classes and attached to pcimPolicyInstance entries in the reusable container 🧸. another option is to use the structural subclasses to define the reusable rules/groups instead 💅. the association classes belonging to a nesting policy set reference those reusable rules/groups through the attribute pcelsPolicySetDN 🔗.

and yes, you can mix both! a combination of specific and reusable components is also allowed for the same policy set 💖✨

4.8. The Aggregation of Actions/Conditions in PolicyRules and CompoundActions/CompoundConditions 💅✨

Okay so, [PCIM_EXT] introduces two new classes that let you build more complex conditions and actions 🧩. CompoundPolicyCondition and CompoundPolicyAction get mapped in this doc to pcelsCompoundConditionAuxClass and pcelsCompoundActionAuxClass, which are subclasses of pcimConditionAuxClass and pcimActionAuxClass. Compounds let a rule associate, group, and evaluate conditions or run actions, and the conditions and actions hook onto a compound the exact same way they hook onto a rule. It's giving modular 🎀

This section explains how to store these classes in an LDAP Directory. The general rule is that specific conditions and actions are subordinated (DIT contained) to the rule or compound that aggregates them, and they're attached to association class instances. Reusable conditions and actions live under pcelsReusableContainer instances and get attached to pcimPolicyInstance instances 🗂️

The examples cover all four combos of specific/reusable and compound/non-compound conditions and actions. Our example rule has two compound conditions, and each of those has two different conditions inside. You can extend these schemes to store actions too 💜

These examples are based on, and extend, the ones from section 4.4 of [PCLS] 🦋

First case: Specific compound condition/action with specific conditions/actions.

                          +--------------+
                   +------|     Rule     |------+
                   |      +--------------+      |
                   |           *    *           |
                   |   *********    *********   |
                   v   *                    *   v
                  +---------+          +---------+
                +-| CA1+cc1 |-+      +-| CA2+cc2 |-+
                | +---------+ |      | +---------+ |
                |     * *     |      |     * *     |
                |  **** ****  |      |  **** ****  |
                v  *       *  v      v  *       *  v
               +------+ +------+    +------+ +------+
               |CA3+c1| |CA4+c2|    |CA5+c3| |CA6+c4|
               +------+ +------+    +------+ +------+

                  +------------------------------+
                  |LEGEND:                       |
                  |  ***** DIT containment       |
                  |    +   auxiliary attachment  |
                  |  ----> DN reference          |
                  +------------------------------+

   #: Number.
   CA#: pcelsConditionAssociation structural class.
   cc#: pcelsCompoundConditionAuxClass auxiliary class.
   c#: subclass of pcimConditionAuxClass.

Figure 6. Specific Compound Conditions with Specific Components

Since the compound conditions and actions are specific to the Rule, they're auxiliary attachments on instances of the structural classes pcelsConditionAssociation or pcelsActionAssociation. These structural classes represent the link between the rule and the compound condition or action 🔗 That means the rule's specific conditions and actions are subordinated (DIT contained) to the rule entry.

The conditions and actions are tied to their compounds in the same way the compounds are tied to rules. Association classes make the connection between the aggregating compound and the specific conditions and actions 💖

Second case: Rule specific compound conditions/actions with reusable conditions/actions.

           +-------------+                   +---------------+
    +------|     Rule    |-----+             |  ContainerX   |
    |      +-------------+     |             +---------------+
    |           *    *         |              *    *    *   *
    |           *    *         |           ****    *    *   *
    |   *********    ********  |           *       *    *   ********
    |   *                   *  v           *       *    *          *
    |   *               +---------+        *       *    ****       *
    |   *             +-| CA2+cc2 |-+      *       *       *       *
    |   *             | +---------+ |      *       *       *       *
    |   *             |    *  *     |      *       *       *       *
    |   *             | ****  ****  |      *       *       *       *
    v   *             | *        *  v      *       *       *       *
   +---------+        | *     +------+  +-----+    *       *       *
 +-| CA1+cc1 |-+      | *     |  CA6 |->|S1+c4|    *       *       *
 | +---------+ |      v *     +------+  +-----+ +-----+    *       *
 |    *  *     |     +------+ +------+  +-----+ +-----+    *       *
 | ****  ****  |     |  CA5 |------------------>|S2+c3|    *       *
 | *        *  v     +------+                   +-----+ +-----+    *
 | *      +------+                                   |S3+c2|    *
 v *      |  CA4 |------------------------------------->|S3+c2|    *
 +------+ +------+                                      +-----+ +-----+
 |  CA3 |------------------------------------------------------>|S4+c1|
 +------+                                                       +-----+

                    +------------------------------+
                    |LEGEND:                       |
                    |  ***** DIT containment       |
                    |    +   auxiliary attachment  |
                    |  ----> DN reference          |
                    +------------------------------+

      #: Number.
      CA#: pcelsConditionAssociation structural class.
      cc#: pcelsCompoundConditionAuxClass auxiliary class.
      c#: subclass of pcimConditionAuxClass.
      S#: structural class

Figure 7. Specific Compound Conditions with Reusable Components

This case is a lot like the first one 🌸 The conditions and actions are reusable, so they aren't attached to the association classes. They hang off structural classes inside the reusable container instead. The association classes use DN references to tie the conditions and actions sitting in a reusable container to their aggregators.

Third case: Reusable compound condition/action with specific conditions/actions.

        +--------------+                  +--------------+
        |     Rule     |                  |  RepositoryX |
    +---+--------------+----+             +--------------+
    |        *     *        |                  *    *
    |  *******     *******  |           ********    ********
    |  *                 *  v           *                  *
    |  *            +----------+    +---------+            *
    |  *            |   CA2    |--->| S1+cc2  |            *
    |  *            +----------+  +-+---------+-+          *
    |  *                          |     * *     |          *
    |  *                          |  **** ****  |          *
    |  *                          v  *       *  v          *
    |  *                         +------+ +------+         *
    |  *                         |CA5+c3| |CA6+c4|         *
    v  *                         +------+ +------+         *
  +----------+                                          +---------+
  |   CA1    |----------------------------------------->| S2+cc1  |
  +----------+                                        +-+---------+-+
                                                      |     * *     |
                                                      |  **** ****  |
                                                      v  *       *  v
                                                     +------+ +------+
                                                     |CA3+c1| |CA4+c2|
                                                     +------+ +------+

                    +------------------------------+
                    |LEGEND:                       |
                    |  ***** DIT containment       |
                    |    +   auxiliary attachment  |
                    |  ----> DN reference          |
                    +------------------------------+

      #: Number.
      CA#: pcelsConditionAssociation structural class.
      cc#: pcelsCompoundConditionAuxClass auxiliary class.
      c#: subclass of pcimConditionAuxClass.
      S#: structural class

Figure 8. Reusable Compound Conditions with Specific Components

Reusable compound conditions and actions are attached to structural classes and stored in a reusable policy container 📦 They relate to the rule through a DN reference attribute in the association classes. Specific conditions and actions are attached to association entries and subordinated (DIT contained) to the compound condition or action that aggregates them 🧁

Fourth case: Reusable conditions/actions and compound conditions/actions.

      +------+          +---------------+    +---------------+
+-----| Rule |-----+    |  ContainerX   |    |  ContainerY   |
|     +------+     |    +---------------+    +---------------+
|      *    *      |         *     *           *   *   *   *
| ******    ****** |       ***     ***       ***   *   *   *****
| *              * v       *         *       *     *   *       *
| *          +-------+  +------+     *       *     *   ***     *
| *          |  CA2  |->|S1+ca1|     *       *     *     *     *
| *          +-------+  +------+     *       *     *     *     *
| *                    /  *  *  \    *       *     *     *     *
| *                    |**   ** |    *       *     *     *     *
| *                    |*     * v    *       *     *     *     *
| *                    |*   +---+    *    +-----+  *     *     *
| *                    |*   |CA6|----*--->|S3+c4|  *     *     *
| *                    v*   +---+    *    +-----+  *     *     *
| *                  +---+           *          +-----+  *     *
| *                  |CA5|-----------*--------->|S4+c3|  *     *
v *                  +---+           *          +-----+  *     *
+-------+                           +------+               *     *
|  CA1  |-------------------------->|S2+cc1|               *     *
+-------+                           +------+               *     *
                                   /  *  *  \              *     *
                                   | **  ** |              *     *
                                   | *    * v              *     *
                                   | *  +---+           +-----+  *
                                   | *  |CA4|---------->|S5+c2|  *
                                   v *  +---+           +-----+  *
                                  +---+                      +-----+
                                  |CA3|--------------------->|S6+c1|
                                  +---+                      +-----+

                    +------------------------------+
                    |LEGEND:                       |
                    |  ***** DIT containment       |
                    |    +   auxiliary attachment  |
                    |  ----> DN reference          |
                    +------------------------------+

      #: Number.
      CA#: pcelsConditionAssociation structural class.
      cc#: pcelsCompoundConditionAuxClass auxiliary class.

      c#: subclass of pcimConditionAuxClass.
      S#: structural class

Figure 9. Reusable Compound Conditions with Reusable Components

Here everything is reusable, so all of it gets stored in reusable containers ✨ The figure shows two reusable policy containers, but how many containers you have in the system is an administrative decision 🏛️ The conditions, actions, and so on may live in the same container or in different ones, and it makes no difference to the policy definition semantics 🌈

5. Class Definitions ✨

okay so this is where we actually get into the classes 🎀 The meanings of the policy info classes that get mapped straight from the information model to LDAP are already spelled out in [PCIM_EXT], so this doc just gives you a quick reminder of those. The real focus here is the mapping itself, going from the info model (which doesn't care what repository or access protocol you use) to something you can reach over LDAP. And it's not always 1:1, because of stuff like LDAP-specific optimization 💅 Some new classes and attributes that weren't in [PCIM] or [PCIM_EXT] had to be made just for the LDAP mapping, and this document fully defines those LDAP-only classes 🦋

These notes apply to this whole section, so read them as the rules of the game 🫶

Note 1: The formal language for specifying the classes, attributes, and DIT structure and content rules is the one defined in [LDAP_SYNTAX]. In the definitions below, the class and attribute definitions follow [LDAP_SYNTAX], but they're line-wrapped so they're easier for humans to read 💖

Note 2: Even if it isn't explicitly noted in the class and attribute definitions below, implementations may define DIT structure and content rules wherever that's applicable and the underlying LDAP infrastructure supports it. In those cases, the DIT structure rule considerations discussed in section 5 of [PCLS] must be applied to PCELS implementations as well. The reasons and details are in [X.501] 🧚

Note 3: Whenever it's possible, an equality, a substrings, and an ordering matching rule get defined for a particular attribute, which gives implementations more flexibility 🌈 BUT, and this is a big but, LDAP matching semantics sometimes don't cover every application need. For example, different values of pcelsIPv4AddrList can be semantically equivalent, and the equality matching rule caseIgnoreMatch attached to this attribute type isn't suitable for spotting that equivalence 😭 So implementers should not rely solely on LDAP syntaxes and matching rules to stay consistent with this specification.

Note 4: The following attribute definitions only use LDAP matching rules and syntax definitions from [LDAP_SYNTAX], [LDAP_SCHEMA], and [LDAP_MATCH]. The matching rules that correspond to them in X.500 are defined in [X.520] ✨

Note 5: Some of the attribute types below MUST conform to additional constraints on their data types. For example, the only valid values for pcelsDecisionStrategy are 1 and 2 💀 Just like the attribute semantics, the value structures, valid ranges, and so on are covered by [PCIM_EXT] for the matching properties, and this document only briefly mentions those constraints. In all cases, if a constraint is violated, the entry SHOULD be treated as invalid, and the policy rules or groups that refer to it SHOULD be treated as being disabled, meaning that executing those policy rules or groups SHOULD be stopped 🙈

Note 5 is the one to keep in your head: break a constraint and the entry is treated as invalid, and anything pointing at it gets disabled and stopped. Not a vibe to ignore 🚨

Note 6: Some of the object classes in this section can't or shouldn't be instantiated directly, because they're either defined as abstract or don't have stand-alone semantics (pcelsValueAuxClass is one example) 🍓 For objects that inherit from those classes, the text says "instances of <class_name>" when the strictly correct phrasing would be "instances of objects that belong to non-abstract subclasses of <class_name>". That omission is on purpose, because it makes the text way easier to read 🫶

5.1. The Abstract Class pcelsPolicySet

The pcelsPolicySet class represents a set of policies that share a decision strategy and a common set of policy roles 🌸 Together with the pcelsPolicySetAssociation class (which gets defined in a later section of this document), it gives applications enough info to apply the right ordering to a set of policies. pcelsPolicySet is mapped from the PolicySet class [PCIM_EXT]. It's an abstract object class, and it's derived from the pcimPolicy class [PCLS] 💜

The pcelsPolicySetList attribute of a pcelsPolicySet instance references the subordinated pcelsPolicySetAssociation entries. The aggregated pcelsPolicySet instances are either attached to the pcelsPolicySetAssociation entries as auxiliary object classes, or they're referenced by the pcelsPolicySetAssociation entries through the pcelsPolicySetDN attribute ✨

The pcelsPolicySet class is defined as follows:

( 1.3.6.1.1.9.1.1
  NAME 'pcelsPolicySet'
  DESC 'Set of policies'
  SUP pcimPolicy
  ABSTRACT
  MAY ( pcelsPolicySetName
      $ pcelsDecisionStrategy
      $ pcimRoles
      $ pcelsPolicySetList )
)

One of the attributes of the pcelsPolicySet class, pcimRoles, is defined in section 5.3 of [PCLS]. In pcelsPolicySet, the pcimRole attribute keeps the syntax and semantics that [PCLS] and [PCIM] give it 🎀

The pcelsPolicySetName attribute type can be used as the naming attribute for pcelsPolicySet entries. It has the Directory String syntax [LDAP_SYNTAX], an equality matching rule of caseIgnoreMatch, an ordering matching rule of caseIgnoreOrderingMatch, and a substrings matching rule of caseIgnoreSubstringsMatch [LDAP_SYNTAX]. Attributes of this type can only have a single value 🦋

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.1
  NAME 'pcelsPolicySetName'
  DESC 'User-friendly name of a policy set'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
)

The pcelsDecisionStrategy attribute type says how the policies aggregated in the policy set get evaluated. It's mapped from the PolicySet.PolicyDecisionStrategy property [PCIM_EXT]. It has the Integer syntax [LDAP_SYNTAX], an equality matching rule of integerMatch [LDAP_SYNTAX], and an ordering matching rule of integerOrderingMatch [LDAP_MATCH]. Attributes of this type can only have a single value. The only allowed values are 1 (FirstMatching) and 2 (AllMatching). If this attribute is missing from a pcelsPolicySet instance, applications MUST assume a FirstMatching decision strategy for the policy set 🔥

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.2
  NAME 'pcelsDecisionStrategy'
  DESC 'Evaluation method for the components of a pcelsPolicySet'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

The pcelsPolicySetList attribute type is used to realize the PolicySetComponent association [PCIM_EXT]. It has the DN syntax [LDAP_SYNTAX] and an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can have multiple values. The only allowed values for pcelsPolicySetList attributes are DNs of pcelsPolicySetAssociation entries. In a pcelsPolicySet, the pcelsPolicySetList attribute represents the associations between that policy set and its components 🌈

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.3
  NAME 'pcelsPolicySetList'
  DESC 'Unordered set of DNs of pcelsPolicySetAssociation entries'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)

Note: A pcelsPolicySet instance aggregates other pcelsPolicySet instances through pcelsPolicySetAssociation entries (defined in the next section) 🧁 Applications can sort the components of a pcelsPolicySet using attributes of the pcelsPolicySetAssociation entries. However, implementations should not expect the LDAP data store to give a useful ordering of the pcelsPolicySetList values in a pcelsPolicySet instance, or to return sets of matching pcelsPolicySetAssociation entries in a meaningful order. Instead, applications SHOULD implement their own post-retrieval ordering of policy rules and groups, based on pcelsPolicySetAssociation.pcelsPriority values 👑

5.2. The Structural Class pcelsPolicySetAssociation

The pcelsPolicySetAssociation class is used to associate PolicySet instances [PCIM_EXT] with other entries. pcelsPolicySetAssociation entries are always subordinated to the aggregating entry. When it's subordinated to an instance of pcelsPolicySet, pcelsPolicySetAssociation realizes a PolicySetComponent association [PCIM_EXT]. When it's subordinated to an instance of dlm1System [CIM_LDAP], pcelsPolicySetAssociation realizes a PolicySetInSystem association [PCIM_EXT] 🦋

pcelsPolicySetAssociation is a structural object class, and it's derived from the pcimPolicy class [PCLS] ✨

The aggregation of a reusable pcelsPolicySet instance is realized through the pcelsPolicySetDN attribute. A non-reusable pcelsPolicySet instance gets attached directly to the pcelsPolicySetAssociation entry, as an auxiliary subclass of pcelsPolicySet 🎀

When reading a pcelsPolicySetAssociation instance that has a pcelsPolicySet attached, the pcelsPolicySetDN attribute MUST be ignored. Applications SHOULD remove the pcelsPolicySetDN value from a pcelsPolicySetAssociation when a pcelsPolicySet gets attached to the entry 🫶

The pcelsPolicySetAssociation class is defined as follows:

( 1.3.6.1.1.9.1.2
  NAME 'pcelsPolicySetAssociation'
  DESC 'Associates a policy set to an aggregating entry'
  SUP pcimPolicy
  STRUCTURAL
  MUST ( pcelsPriority )
  MAY ( pcelsPolicySetName
      $ pcelsPolicySetDN )
)

The pcelsPriority attribute type indicates the priority of a policy set component 💅 It has the Integer syntax [LDAP_SYNTAX], an equality matching rule of integerMatch [LDAP_SYNTAX], and an ordering matching rule of integerOrderingMatch [LDAP_MATCH]. Attributes of this type can only have single values. The only allowed values are non-negative integers. Within the set of pcelsPolicySetAssociation entries directly subordinated to a pcelsPolicySet or a dlm1System [CIM_LDAP], the pcelsPriority values MUST be unique 🔥

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.4
  NAME 'pcelsPriority'
  DESC 'Priority of a component'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

The pcelsPolicySetDN attribute type is used in the aggregation of PolicySet instances [PCIM_EXT]. It has the DN syntax [LDAP_SYNTAX] and an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can only have single values. The only allowed values for pcelsPolicySetDN attributes are DNs of pcelsPolicySet entries 🌸

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.5
  NAME 'pcelsPolicySetDN'
  DESC 'DN of a pcelsPolicySet entry'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
  SINGLE-VALUE
)

5.3. The Three Policy Group Classes ✨

okay so pcelsGroup is the base class for representing a policy group 💖 It's mapped from the modified PolicyGroup class [PCIM_EXT], and it's derived from pcelsPolicySet. To keep things flexible, pcelsGroup is defined as abstract 🦋 Then there's an auxiliary subclass, pcelsGroupAuxClass, which lets you attach a policy group to an existing entry, and a structural subclass, pcelsGroupInstance, which lets a policy group live as its own standalone entry 🫶

The pcelsGroup class is defined as follows:

( 1.3.6.1.1.9.1.3
  NAME 'pcelsGroup'
  DESC 'Base class for representing a policy group'
  SUP pcelsPolicySet
  ABSTRACT
  MAY ( pcimGroupName )
)

The pcelsGroupAuxClass class is defined as follows:

( 1.3.6.1.1.9.1.4
  NAME 'pcelsGroupAuxClass'
  DESC 'Auxiliary class for representing a policy group'
  SUP pcelsGroup
  AUXILIARY
)

The pcelsGroupInstance class is defined as follows:

( 1.3.6.1.1.9.1.5
  NAME 'pcelsGroupInstance'
  DESC 'Structural class for representing a policy group'
  SUP pcelsGroup
  STRUCTURAL
)

The pcimGroupName attribute type used by the pcelsGroup class is defined in section 5.2 of [PCLS] ✨ In the pcelsGroup object class, this attribute keeps its syntax and semantics as defined by [PCLS] and [PCIM], so nothing changes there 🌸

Note: PCELS implementations SHOULD support pcelsGroup and its two subclasses 💅 and MAY also support pcimGroup and its two subclasses [PCLS]. Applications that choose to support pcelsGroup and its two subclasses MUST use the aggregation mechanism provided by pcelsPolicySetAssociation for aggregating policy groups, or policy rules in policy groups, represented as instances of pcelsGroup. This part is a must, bestie 😭🔥

5.4. The Three Policy Rule Classes 👑

pcelsRule is the base class for representing a policy rule 🎀 It's mapped from the modified PolicyRule class [PCIM_EXT], and it's derived from pcelsPolicySet. Just like pcelsGroup, it's defined as abstract for maximum flexibility 🧚 The auxiliary subclass pcelsRuleAuxClass attaches a policy rule to an existing entry, and the structural subclass pcelsRuleInstance represents a policy rule as a standalone entry 💜

Now here's the tea about compound conditions and actions 🫖 When you read a pcelsRule instance that has a pcimConditionAuxClass attached, from the policy rule perspective the pcelsConditionList attribute MUST be ignored. If it's present, it MUST NOT be treated as an association between this policy rule and a policy condition. This can happen, for example, when a pcelsCompoundConditionAuxClass is attached to a pcelsRule instance 💀

Same energy for actions 🍓 When you read a pcelsRule instance that has a pcimActionAuxClass attached, from the policy rule perspective the pcelsActionList attribute MUST be ignored. If it's present, it MUST NOT be treated as an association between this policy rule and a policy action. This can happen, for example, when a pcelsCompoundActionAuxClass is attached to a pcelsRule instance ✨

The pcelsRule class is defined as follows:

( 1.3.6.1.1.9.1.6
  NAME 'pcelsRule'
  DESC 'Base class for representing a policy rule'
  SUP pcelsPolicySet
  ABSTRACT
  MAY ( pcimRuleName
      $ pcimRuleEnabled
      $ pcimRuleUsage
      $ pcimRuleMandatory
      $ pcelsRuleValidityPeriodList
      $ pcelsConditionListType
      $ pcelsConditionList
      $ pcelsActionList
      $ pcelsSequencedActions
      $ pcelsExecutionStrategy )
)

The pcelsRuleAuxClass class is defined as follows:

( 1.3.6.1.1.9.1.7
  NAME 'pcelsRuleAuxClass'
  DESC 'Auxiliary class for representing a policy rule'
  SUP pcelsRule
  AUXILIARY
)

The pcelsRuleInstance class is defined as follows:

( 1.3.6.1.1.9.1.8
  NAME 'pcelsRuleInstance'
  DESC 'Structural class for representing a policy rule'
  SUP pcelsRule
  STRUCTURAL
)

Four of the attributes used by the pcelsRule class are defined in section 5.3 of [PCLS] 🦋 They are pcimRuleName, pcimRuleEnabled, pcimRuleUsage and pcimRuleMandatory. In the pcelsRule object class, these attributes keep their syntax and semantics as defined by [PCLS] and [PCIM] 🌈

Here's the plot twist 🎭 The attributes pcimRuleValidityPeriodList, pcimRuleConditionListType, pcimRuleConditionList, pcimRuleActionList and pcimRuleSequencedActions defined in [PCLS] are NOT used by pcelsRule. Instead, this class uses the new attributes pcelsRuleValidityPeriodList, pcelsConditionListType, pcelsConditionList, pcelsActionList and pcelsSequencedActions. Except for pcelsRuleValidityPeriodList, these new attributes are also used for a similar purpose by either pcelsCompoundConditionAuxClass or pcelsCompoundActionAuxClass 🙈

Let's talk about pcelsRuleValidityPeriodList 🕰️ It's used in the realization of the PolicyRuleValidityPeriod association ([PCIM_EXT] and [PCIM]). This attribute type is of syntax DN [LDAP_SYNTAX] and has an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can have multiple values. The only allowed values for pcelsRuleValidityPeriodList attributes are DNs of pcimRuleValidityAssociation entries. In a pcelsRule, this attribute represents the associations between the policy rule and its time period conditions 🌸

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.62
  NAME 'pcelsRuleValidityPeriodList'
  DESC 'Unordered set of DNs of pcimRuleValidityAssociation entries'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)

The pcelsConditionListType attribute type tells you whether the set of aggregated conditions is in disjunctive or conjunctive normal form 🧠 It's mapped from the PolicyRule.ConditionListType property [PCIM] (identical to the CompoundPolicyCondition.ConditionListType property defined in [PCIM_EXT]). This attribute type is of syntax Integer [LDAP_SYNTAX], with an equality matching rule of integerMatch [LDAP_SYNTAX] and an ordering matching rule of integerOrderingMatch [LDAP_MATCH]. Attributes of this type can only have a single value. The only allowed values are 1 (Disjunctive) and 2 (Conjunctive). If this attribute is missing from a pcelsRule instance, applications MUST assume that the set of aggregated conditions is in disjunctive normal form 🫶

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.6
  NAME 'pcelsConditionListType'
  DESC 'Indicates the type of condition aggregation'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

The pcelsConditionList attribute type is used in the realization of the PolicyConditionStructure association [PCIM_EXT] 💖 It's of syntax DN [LDAP_SYNTAX], with an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can have multiple values. The only allowed values are DNs of pcelsConditionAssociation entries. In a pcelsRule, this attribute represents the associations between the policy rule and its conditions ✨

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.7
  NAME 'pcelsConditionList'
  DESC 'Unordered set of DNs of pcelsConditionAssociation entries'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)

The pcelsActionList attribute type is used in the realization of the PolicyActionStructure association [PCIM_EXT] 🎀 It's of syntax DN [LDAP_SYNTAX], with an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can have multiple values. The only allowed values are DNs of pcelsActionAssociation entries. In a pcelsRule, this attribute represents the associations between the policy rule and its actions 🦋

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.8
  NAME 'pcelsActionList'
  DESC 'Unordered set of DNs of pcelsActionAssociation entries'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)

The pcelsSequencedActions attribute type indicates whether the ordered execution of actions in an aggregate is Mandatory, Recommended or DontCare 🌈 It's mapped from the PolicyRule.SequencedActions property [PCIM] (identical to the CompoundPolicyAction.SequencedActions property defined in [PCIM_EXT]). This attribute type is of syntax Integer [LDAP_SYNTAX], with an equality matching rule of integerMatch [LDAP_SYNTAX] and an ordering matching rule of integerOrderingMatch [LDAP_MATCH]. Attributes of this type can only have a single value. The only allowed values are 1 (Mandatory), 2 (Recommended) and 3 (DontCare). If this attribute is missing from a pcelsRule instance, applications MUST assume that the ordered execution of actions in this rule is not important (DontCare) 🙈

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.9
  NAME 'pcelsSequencedActions'
  DESC 'Indicates the importance of action sequencing'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

The pcelsExecutionStrategy attribute type indicates whether the actions in an aggregate are to be executed until success, all (independent of their outcome) or until failure 🔥 It's mapped from the PolicyRule.ExecutionStrategy property [PCIM_EXT] (identical to the CompoundPolicyAction.ExecutionStrategy property). This attribute type is of syntax Integer [LDAP_SYNTAX], with an equality matching rule of integerMatch [LDAP_SYNTAX] and an ordering matching rule of integerOrderingMatch [LDAP_MATCH]. Attributes of this type can only have a single value. The only allowed values are 1 (Do until success), 2 (Do all) and 3 (Do until failure). If this attribute is missing from a pcelsRule instance, applications MUST assume that all the actions are to be executed (Do all) 💅

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.10
  NAME 'pcelsExecutionStrategy'
  DESC 'Indicates the action execution strategy'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

Note 1: Rule validity periods for an instance of pcelsRule are realized using the attribute pcelsRuleValidityPeriodList and pcimRuleValidityAssociation [PCLS] entries subordinated to the rule 🧚

If DIT structure rules and name forms are written for a PCELS implementation (as suggested in section 5.5 of [PCLS]), they would require that an instance of the pcimRuleValidityAssociation class have as its superior an instance of the pcelsRule class or, if applicable, an instance of the pcimRule class. Any structure rules and name forms that require an instance of the pcimRuleValidityAssociation class to have as its superior only an instance of the pcimRule class are in conflict and MUST be removed 🚨

Note 2: PCELS implementations SHOULD support pcelsRule and its two subclasses 💜 and MAY also support pcimRule and its two subclasses [PCLS]. Applications that choose to support pcelsRule and its two subclasses MUST use the aggregation mechanism provided by pcelsPolicySetAssociation for aggregating policy groups or policy rules in policy rules represented as instances of pcelsRule. Bestie, that's the whole vibe 🫶

5.5. The Structural Class pcelsConditionAssociation 💅

okay bestie, so pcelsConditionAssociation is the class used to aggregate PolicyCondition instances [PCIM] 🫶. These entries are ALWAYS subordinated to the aggregating entry, meaning they live underneath it. When one hangs under a pcelsRule, it realizes the PolicyConditionInPolicyRule association [PCIM_EXT]. When it hangs under a pcelsCompoundConditionAuxClass, it realizes the PolicyConditionInPolicyCondition association [PCIM_EXT] ✨.

It's a structural object class, and it's derived from pcimRuleConditionAssociation [PCLS] 🎀.

A reusable instance of pcimConditionAuxClass gets aggregated through the pcimConditionDN attribute. A non-reusable instance of pcimConditionAuxClass just gets attached directly to the pcelsConditionAssociation entry 🌸.

Now the drama 🙈 When you read a pcelsConditionAssociation entry that already has a pcimConditionAuxClass instance attached, the attribute pcimConditionDN MUST be ignored. Also, applications SHOULD remove the pcimConditionDN value from a pcelsConditionAssociation when a pcimConditionAuxClass gets attached to the entry. Clean up after yourself, periodt 💅

The class definition is:

( 1.3.6.1.1.9.1.9
  NAME 'pcelsConditionAssociation'
  DESC 'Associates a policy conditions to an aggregating entry'
  SUP pcimRuleConditionAssociation
  STRUCTURAL
)

This class extends the semantics of the pcimRuleConditionAssociation object class but doesn't add any new attributes. All of its attributes are inherited from the pcimRuleConditionAssociation defined in section 5.4 of [PCLS] 💖.

5.6. The Structural Class pcelsActionAssociation 🦋

The pcelsActionAssociation class is used to aggregate PolicyAction instances [PCIM] 💜. These entries are always subordinated to the aggregating entry. When one hangs under a pcelsRule instance, it realizes the PolicyActionInPolicyRule association [PCIM_EXT]. When it hangs under an instance of pcelsCompoundActionAuxClass, it realizes the PolicyActionInPolicyAction association [PCIM_EXT] 🌈.

It's a structural object class too, and it's derived from the pcimRuleActionAssociation class [PCLS] ⭐.

A reusable instance of pcimActionAuxClass gets aggregated via the pcimActionDN attribute. A non-reusable instance of pcimActionAuxClass gets attached directly to the pcelsActionAssociation entry 🍓.

Same energy as before: when you read a pcelsActionAssociation entry that has a pcimActionAuxClass instance attached, the attribute pcimActionDN MUST be ignored. Applications SHOULD also remove the pcimActionDN value from a pcelsActionAssociation when a pcimActionAuxClass is attached to the entry 🧚

The class definition goes like this:

( 1.3.6.1.1.9.1.10
  NAME 'pcelsActionAssociation'
  DESC 'Associates a policy conditions to an aggregating entry'
  SUP pcimRuleActionAssociation
  STRUCTURAL
)

This class extends the semantics of the pcimRuleActionAssociation object class without using any new attributes. All of its attributes are inherited from the pcimRuleActionAssociation defined in section 5.6 of [PCLS] 🫶.

5.7. The Auxiliary Class pcelsSimpleConditionAuxClass 🎀

The pcelsSimpleConditionAuxClass class implements a Value matching condition for a Variable. It's mapped from the SimplePolicyCondition class [PCIM_EXT]. It's an auxiliary object class, derived from the pcimConditionAuxClass class [PCLS] ✨.

A reusable variable/value pair gets associated to a pcelsSimpleConditionAuxClass through the pcelsVariableDN/pcelsValueDN reference from the simple condition instance. A non-reusable variable/value is associated directly, as an auxiliary object class, to the same entry as the pcelsSimpleConditionAuxClass instance 💅

Okay, so for the variable side: when you read a pcelsSimpleConditionAuxClass instance that has a pcelsVariable instance attached, the attribute pcelsVariableDN MUST be ignored. And applications SHOULD remove the pcelsVariableDN value from a pcelsSimpleConditionAuxClass instance when a pcelsVariable instance gets attached to the same entry 🌸.

The value side is basically the same vibe: when you read a pcelsSimpleConditionAuxClass instance that has a pcelsValue instance attached, the attribute pcelsValueDN MUST be ignored. Applications SHOULD remove the pcelsValueDN value from a pcelsSimpleConditionAuxClass instance when a pcelsValue instance gets attached to the same entry 🌈.

The class definition:

( 1.3.6.1.1.9.1.11
  NAME 'pcelsSimpleConditionAuxClass'
  DESC 'Value matching condition for a policy variable'
  SUP pcimConditionAuxClass
  AUXILIARY
  MAY ( pcelsVariableDN
      $ pcelsValueDN )
)

The pcelsVariableDN attribute type realizes the PolicyVariableInSimplePolicyCondition association [PCIM_EXT] 💜. It's of syntax DN [LDAP_SYNTAX] and has an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can only have a single value. The ONLY allowed values for pcelsVariableDN attributes are DNs of pcelsVariable entries. In a pcelsSimpleConditionAuxClass, the pcelsVariableDN attribute represents the association between this simple policy condition and its policy variable 🦋.

It's defined like this:

( 1.3.6.1.1.9.2.11
  NAME 'pcelsVariableDN'
  DESC 'DN of a pcelsVariable entry'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
  SINGLE-VALUE
)

The pcelsValueDN attribute type realizes the PolicyValueInSimplePolicyCondition association [PCIM_EXT] 🍓. It's of syntax DN [LDAP_SYNTAX] and has an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can only have a single value. The ONLY allowed values for pcelsValueDN attributes are DNs of pcelsValueAuxClass entries. In a pcelsSimpleConditionAuxClass, the pcelsValueDN attribute represents the association between this simple policy condition and its policy value ⭐.

It's defined like this:

( 1.3.6.1.1.9.2.12
  NAME 'pcelsValueDN'
  DESC 'DN of a pcelsValueAuxClass entry'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
  SINGLE-VALUE
)
Note: An instance of pcelsSimpleActionAuxClass and an instance of pcelsSimpleConditionAuxClass MUST NOT be attached to the same entry. Because the two classes use the same mechanisms to associate Variables and Values, this restriction is necessary in order to avoid ambiguities 🙈

5.8. The Auxiliary Class pcelsCompoundConditionAuxClass 🧚

The pcelsCompoundConditionAuxClass class represents a compound policy condition, which is formed by aggregating other policy conditions. It's mapped from the CompoundPolicyCondition class [PCIM_EXT]. It's an auxiliary object class and it's derived from the pcimConditionAuxClass class [PCLS] 💖.

The class definition:

( 1.3.6.1.1.9.1.12
  NAME 'pcelsCompoundConditionAuxClass'
  DESC 'Boolean combination of simpler conditions'
  SUP pcimConditionAuxClass
  AUXILIARY
  MAY ( pcelsConditionListType
      $ pcelsConditionList )
)

If the pcelsConditionListType attribute is missing from a pcelsCompoundConditionAuxClass instance, applications MUST assume that the set of aggregated conditions is in disjunctive normal form. Bestie, don't skip this one 💀

In a pcelsCompoundConditionAuxClass instance, the pcelsConditionList attribute represents the associations between this compound policy condition and the conditions it's compounding 🌸.

These attribute types are defined in section 5.4 🎀.

Like pcelsRule, instances of pcelsCompoundConditionAuxClass use pcelsConditionList values and subordinated pcelsConditionAssociation entries to aggregate policy conditions ✨.

5.9. The Auxiliary Class pcelsCompoundFilterConditionAuxClass 🌈

The pcelsCompoundFilterConditionAuxClass class represents a domain-level filter 🦋. It's mapped from the CompoundFilterCondition class [PCIM_EXT]. It's an auxiliary object class and it's derived from the pcelsCompoundConditionAuxClass class.

The class definition:

( 1.3.6.1.1.9.1.13
  NAME 'pcelsCompoundFilterConditionAuxClass'
  DESC 'A compound condition with mirroring capabilities'
  SUP pcelsCompoundConditionAuxClass
  AUXILIARY
  MAY ( pcelsIsMirrored )
)

The pcelsIsMirrored attribute type indicates whether the traffic that mirrors the specified filter is to be treated as matching the filter 💜. It's mapped from the CompoundFilterCondition.IsMirrored property [PCIM_EXT]. This attribute type is of syntax Boolean [LDAP_SYNTAX] and has an equality matching rule of booleanMatch [LDAP_MATCH] 🫶.

Attributes of this type can only have a single value. If this attribute is missing from a pcelsCompoundFilterConditionAuxClass instance, applications MUST assume that the filter is not mirrored 🙈.

It's defined like this:

( 1.3.6.1.1.9.2.13
  NAME 'pcelsIsMirrored'
  DESC 'Indicates whether the mirrored traffic matches'
  EQUALITY booleanMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
  SINGLE-VALUE
)

5.10. The Auxiliary Class pcelsSimpleActionAuxClass 💅

Okay bestie, pcelsSimpleActionAuxClass is all about assigning a Value to a Variable 🎀. It's mapped from the SimplePolicyAction class [PCIM_EXT] ✨. It's an auxiliary object class, and it's derived from the pcimActionAuxClass class [PCLS] 🦋.

A reusable variable/value gets linked up through the pcelsVariableDN/pcelsValueDN reference on the simple action instance 🧚. A non-reusable variable/value is different: it gets attached directly as an auxiliary object class on the same entry as the pcelsSimpleActionAuxClass instance 🌸.

When you read a pcelsSimpleActionAuxClass instance that has a pcelsVariable instance attached, the pcelsVariableDN attribute MUST be ignored 🙈. Applications SHOULD remove the pcelsVariableDN value from a pcelsSimpleActionAuxClass instance when a pcelsVariable instance gets attached to the same entry.

Same deal for values: when you read a pcelsSimpleActionAuxClass instance that has a pcelsValue instance attached, the pcelsValueDN attribute MUST be ignored. Applications SHOULD remove the pcelsValueDN value from a pcelsSimpleActionAuxClass instance when a pcelsValue instance gets attached to the same entry 💖.

The pcelsSimpleActionAuxClass class is defined as follows:

( 1.3.6.1.1.9.1.14
  NAME 'pcelsSimpleActionAuxClass'
  DESC 'Value assignment action for a policy variable'
  SUP pcimActionAuxClass
  AUXILIARY
  MAY ( pcelsVariableDN
      $ pcelsValueDN )
)

In a pcelsSimpleActionAuxClass, the pcelsVariableDN attribute represents the association between this simple policy action and its policy variable. It realizes the PolicyVariableInSimplePolicyAction association [PCIM_EXT] 🔥.

In a pcelsSimpleActionAuxClass, the pcelsValueDN attribute represents the association between this simple policy action and its policy value. It realizes the PolicyValueInSimplePolicyAction association [PCIM_EXT] 👑.

These attributes are defined in section 5.7.

Note: An instance of pcelsSimpleActionAuxClass and an instance of pcelsSimpleConditionAuxClass MUST NOT be attached to the same entry. Because the two classes use the same mechanisms to associate Variables and Values, this restriction is necessary in order to avoid ambiguities 🙅‍♀️

5.11. The Auxiliary Class pcelsCompoundActionAuxClass 🌈

The pcelsCompoundActionAuxClass class represents a compound policy action formed by aggregating other policy actions ⭐. It's mapped from the CompoundPolicyCondition class [PCIM_EXT]. It's an auxiliary object class and it's derived from the pcimActionAuxClass class [PCLS] 💜.

The pcelsCompoundActionAuxClass class is defined as follows:

( 1.3.6.1.1.9.1.15
  NAME 'pcelsCompoundActionAuxClass'
  DESC 'Sequence of actions with specific execution strategy'
  SUP pcimActionAuxClass
  AUXILIARY
  MAY ( pcelsActionList
      $ pcelsSequencedActions
      $ pcelsExecutionStrategy )
)

In a pcelsCompoundActionAuxClass instance, the pcelsActionList attribute represents the associations between this policy rule and its actions 🦋.

If the pcelsSequencedActions attribute is missing from a pcelsCompoundActionAuxClass instance, applications MUST assume that the ordered execution of actions in this compound policy action is not important (DontCare) 🤷‍♀️.

If the pcelsExecutionStrategy attribute is missing from a pcelsCompoundActionAuxClass instance, applications MUST assume that all the actions are to be executed (Do all) ✅.

These attribute types are defined in section 5.4.

Like pcelsRule, instances of pcelsCompoundActionAuxClass use pcelsActionList values and subordinated pcelsActionAssociation entries to aggregate policy actions 🧩.

5.12. The Abstract Class pcelsVariable 🎀

The pcelsVariable class is mapped from the PolicyVariable class [PCIM_EXT]. It's an abstract object class and it's derived directly from the 'top' object class [LDAP_SCHEMA] 🌸.

A pcelsVariable instance may be associated to a set of pcelsValueAuxClass instances that represent its expected values. The expected values for a variable may be indicated by:

  1. pcelsExpectedValueList references to reusable instances of pcelsValueAuxClass, or
  2. pcelsExpectedValueList references to subordinated non-reusable instances of pcelsValueAuxClass

The pcelsVariable class is defined as follows:

( 1.3.6.1.1.9.1.16
  NAME 'pcelsVariable'
  DESC 'Base class for representing a policy variable'
  SUP top
  ABSTRACT
  MAY ( pcelsVariableName
      $ pcelsExpectedValueList )
)

The pcelsVariableName attribute type may be used as naming attribute for pcelsVariable entries 🏷️. This attribute type is of syntax Directory String [LDAP_SYNTAX]. It has an equality matching rule of caseIgnoreMatch, an ordering matching rule of caseIgnoreOrderingMatch and a substrings matching rule of caseIgnoreSubstringsMatch [LDAP_SYNTAX]. Attributes of this type can only have a single value.

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.14
  NAME 'pcelsVariableName'
  DESC 'The user-friendly name of a variable.'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
)

The pcelsExpectedValueList attribute type realizes the ExpectedPolicyValuesForVariable association [PCIM_EXT] 💫. This attribute type is of syntax DN [LDAP_SYNTAX]. It has an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can have multiple values. The only allowed values for pcelsExpectedValueList attributes are DNs of pcelsValueAuxClass entries. In a pcelsVariable, the pcelsExpectedValueList attribute represents the associations between this policy variable and its expected values 🍓.

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.15
  NAME 'pcelsExpectedValueList'
  DESC 'Unordered set of DNs of pcelsValueAuxClass entries
        representing expected values for a policy variable'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)

5.13. The Auxiliary Class pcelsExplicitVariableAuxClass 🧚

The pcelsExplicitVariableAuxClass class is mapped from the PolicyExplicitVariable class [PCIM_EXT]. It's an auxiliary object class and it's derived from the pcelsVariable class 🦋.

The pcelsExplicitVariableAuxClass class is defined as follows:

( 1.3.6.1.1.9.1.17
  NAME 'pcelsExplicitVariableAuxClass'
  DESC 'Explicitly defined policy variable'
  SUP pcelsVariable
  AUXILIARY
  MUST ( pcelsVariableModelClass
       $ pcelsVariableModelProperty )
)

The pcelsVariableModelClass attribute type identifies a [CIM] class whose property is evaluated or set as a variable. It's mapped from the PolicyExplicitVariable.ModelClass property [PCIM_EXT]. This attribute type is of syntax Directory String [LDAP_SYNTAX]. It has an equality matching rule of caseIgnoreMatch [LDAP_SYNTAX]. Attributes of this type can only have a single value.

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.16
  NAME 'pcelsVariableModelClass'
  DESC 'Identifies a CIM class'
  EQUALITY caseIgnoreMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
)

The pcelsVariableModelProperty attribute type identifies the attribute of a [CIM] class, which is evaluated or set as a variable. It's mapped from the PolicyExplicitVariable.ModelProperty property [PCIM_EXT]. This attribute type is of syntax Directory String [LDAP_SYNTAX]. It has an equality matching rule of caseIgnoreMatch [LDAP_SYNTAX]. Attributes of this type can only have a single value.

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.17
  NAME 'pcelsVariableModelProperty'
  DESC 'Identifies the property of a CIM class.'
  EQUALITY caseIgnoreMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
)

5.14. The Auxiliary Class pcelsImplicitVariableAuxClass ✨

The pcelsImplicitVariableAuxClass class is mapped from the PolicyImplicitVariable class [PCIM_EXT]. It's an auxiliary object class and it's derived from the pcelsVariable class 💅.

The pcelsImplicitVariableAuxClass class does not represent actual variables; these are introduced by its subclasses. pcelsImplicitVariableAuxClass introduces the semantics of being an implicitly defined policy variable, and these semantics are inherited by all its subclasses. These semantics include those inherited from pcelsVariable that possibly represent either rule-specific or reusable policy variables 🌷.

To preserve the ability to represent rule-specific or reusable variables, all the subclasses of pcelsImplicitVariableAuxClass MUST also be auxiliary classes 🫶.

The pcelsImplicitVariableAuxClass class is defined as follows:

( 1.3.6.1.1.9.1.18
  NAME 'pcelsImplicitVariableAuxClass'
  DESC 'Implicitly defined policy variable'
  SUP pcelsVariable
  AUXILIARY
  MAY ( pcelsExpectedValueTypes )
)

The pcelsExpectedValueTypes attribute type represents the set of policy value types that may be used with this policy variable. It's mapped from the PolicyImplicitVariable.ValueTypes property [PCIM_EXT]. This attribute type is of syntax Directory String [LDAP_SYNTAX]. It has an equality matching rule of caseIgnoreMatch [LDAP_SYNTAX]. Attributes of this type can have multiple values.

This attribute type is defined as follows:

( 1.3.6.1.1.9.2.18
  NAME 'pcelsExpectedValueTypes'
  DESC 'Identifies subclasses of pcelsValueAuxClass by name'
  EQUALITY caseIgnoreMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)

5.15. The Subclasses of pcelsImplicitVariableAuxClass 🌈

The following classes are derived from the pcelsImplicitVariableAuxClass class. They're mapped from the corresponding subclasses of the PolicyImplicitVariable class [PCIM_EXT]. All the classes defined below are auxiliary object classes 🦋.

Each one of the classes defined in this section introduces specific restrictions for the values of the pcelsExpectedValueTypes attribute. If this attribute is missing, applications MUST assume that all allowed value types are expected for the policy variable 🧐.

Some of these classes have additional restrictions on the actual values of the associated policy value instances (e.g., only integers in the range 0..65535 must be used with a SourcePort variable). The association between a pcelsImplicitVariableAuxClass instance and a pcelsValueAuxClass instance that contains values outside the valid range or set for that variable SHOULD be considered invalid. The entry that realizes such association SHOULD be treated as invalid, and the policy rules or groups that refer to it SHOULD be treated as being disabled, meaning that the execution of such policy rules or groups SHOULD be stopped 🚫.

The pcelsSourceIPv4VariableAuxClass class is defined as follows:

( 1.3.6.1.1.9.1.19
  NAME 'pcelsSourceIPv4VariableAuxClass'
  DESC 'Source IP v4 address'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsSourceIPv4VariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsIPv4AddrValueAuxClass'. 🌸

The pcelsSourceIPv6VariableAuxClass class is defined as follows:

Okay bestie, the source IP v6 one is up first 🌸 It's an auxiliary class that sits under pcelsImplicitVariableAuxClass, and it's giving very specific energy:

( 1.3.6.1.1.9.1.20
  NAME 'pcelsSourceIPv6VariableAuxClass'
  DESC 'Source IP v6 address'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsSourceIPv6VariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsIPv6AddrValueAuxClass'. One option, no cap, very clean 💅

Next up is the destination IP v4 class 🦋 It's defined like this:

( 1.3.6.1.1.9.1.21
  NAME 'pcelsDestinationIPv4VariableAuxClass'
  DESC 'Destination IP v4 address'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsDestinationIPv4VariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsIPv4AddrValueAuxClass'.

Now the destination IP v6 class 💜

( 1.3.6.1.1.9.1.22
  NAME 'pcelsDestinationIPv6VariableAuxClass'
  DESC 'Destination IP v6 address'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsDestinationIPv6VariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsIPv6AddrValueAuxClass'.

The source port class is next 🎀

( 1.3.6.1.1.9.1.23
  NAME 'pcelsSourcePortVariableAuxClass'
  DESC 'Source port'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsSourcePortVariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsIntegerValueAuxClass'. Additionally, only policy values that represent integers in the range 0..65535 (inclusive) SHOULD be used with pcelsSourcePortVariableAuxClass instances.

Then the destination port class 🍓

( 1.3.6.1.1.9.1.24
  NAME 'pcelsDestinationPortVariableAuxClass'
  DESC 'Destination port'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsDestinationPortVariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsIntegerValueAuxClass'. Additionally, only policy values that represent integers in the range 0..65535 (inclusive) SHOULD be used with pcelsDestinationPortVariableAuxClass instances.

The IP protocol class is defined as follows 🧚

( 1.3.6.1.1.9.1.25
  NAME 'pcelsIPProtocolVariableAuxClass'
  DESC 'IP protocol number'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsIPProtocolVariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsIntegerValueAuxClass'. Additionally, only policy values that represent integers in the range 0..255 (inclusive) SHOULD be used with pcelsIPProtocolVariableAuxClass instances.

Next is the IP version class ✨

( 1.3.6.1.1.9.1.26
  NAME 'pcelsIPVersionVariableAuxClass'
  DESC 'IP version number'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsIPVersionVariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsIntegerValueAuxClass'. Additionally, only policy values that represent integers in the range 0..15 (inclusive) SHOULD be used with pcelsIPVersionVariableAuxClass instances.

The IP ToS class is up next 🌈

( 1.3.6.1.1.9.1.27
  NAME 'pcelsIPToSVariableAuxClass'
  DESC 'IP ToS octet'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsIPToSVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..255 (inclusive) or 8-bit bitStrings SHOULD be used with pcelsIPToSVariableAuxClass instances.

Then the DSCP class 🦋

( 1.3.6.1.1.9.1.28
  NAME 'pcelsDSCPVariableAuxClass'
  DESC 'DiffServ code point'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsDSCPVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..63 (inclusive) or 6-bit bitStrings SHOULD be used with pcelsDSCPVariableAuxClass instances.

The flow ID class is defined as follows 💜

( 1.3.6.1.1.9.1.29
  NAME 'pcelsFlowIdVariableAuxClass'
  DESC 'Flow Identifier'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsFlowIdVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..1048575 (inclusive) or 20-bit bitStrings SHOULD be used with pcelsFlowIdVariableAuxClass instances.

Next, the source MAC address class 🌸

( 1.3.6.1.1.9.1.30
  NAME 'pcelsSourceMACVariableAuxClass'
  DESC 'Source MAC address'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsSourceMACVariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsMACAddrValueAuxClass'.

The destination MAC address class is defined as follows 🫶

( 1.3.6.1.1.9.1.31
  NAME 'pcelsDestinationMACVariableAuxClass'
  DESC 'Destination MAC address'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsDestinationMACVariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsMACAddrValueAuxClass'.

Now the VLAN class 🎀

( 1.3.6.1.1.9.1.32
  NAME 'pcelsVLANVariableAuxClass'
  DESC 'VLAN'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsVLANVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..4095 (inclusive) or 12-bit bitStrings SHOULD be used with pcelsVLANVariableAuxClass instances.

The class of service class is next 👑

( 1.3.6.1.1.9.1.33
  NAME 'pcelsCoSVariableAuxClass'
  DESC 'Class of service'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsCoSVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..7 (inclusive) or 3-bit bitStrings SHOULD be used with pcelsCoSVariableAuxClass instances.

Then the Ethertype class 🧚

( 1.3.6.1.1.9.1.34
  NAME 'pcelsEthertypeVariableAuxClass'
  DESC 'Ethertype'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsEthertypeVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..65535 (inclusive) or 16-bit bitStrings SHOULD be used with pcelsEthertypeVariableAuxClass instances.

The source SAP class is defined as follows ✨

( 1.3.6.1.1.9.1.35
  NAME 'pcelsSourceSAPVariableAuxClass'
  DESC 'Source SAP'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsSourceSAPVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..255 (inclusive) or 8-bit bitStrings SHOULD be used with pcelsSourceSAPVariableAuxClass instances.

And the destination SAP class 🌈

( 1.3.6.1.1.9.1.36
  NAME 'pcelsDestinationSAPVariableAuxClass'
  DESC 'Destination SAP'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsDestinationSAPVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..255 (inclusive) or 8-bit bitStrings SHOULD be used with pcelsDestinationSAPVariableAuxClass instances.

The SNAP OUI class comes next 🦋

( 1.3.6.1.1.9.1.37
  NAME 'pcelsSNAPOUIVariableAuxClass'
  DESC 'SNAP OUI'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsSNAPOUIVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..16777215 (inclusive) or 24-bit bitStrings SHOULD be used with pcelsSNAPOUIVariableAuxClass instances.

Then the SNAP type class 💜

( 1.3.6.1.1.9.1.38
  NAME 'pcelsSNAPTypeVariableAuxClass'
  DESC 'SNAP type'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsSNAPTypeVariableAuxClass instance, the only allowed values for the pcelsExpectedValueTypes attribute are 'pcelsIntegerValueAuxClass' and 'pcelsBitStringValueAuxClass'. Additionally, only policy values that represent integers in the range 0..65535 (inclusive) or 16-bit bitStrings SHOULD be used with pcelsSNAPTypeVariableAuxClass instances.

Last one in this stretch is the flow direction class 🌸

( 1.3.6.1.1.9.1.39
  NAME 'pcelsFlowDirectionVariableAuxClass'
  DESC 'Flow direction'
  SUP pcelsImplicitVariableAuxClass
  AUXILIARY
)

In a pcelsFlowDirectionVariableAuxClass instance, the only allowed value for the pcelsExpectedValueTypes attribute is 'pcelsStringValueAuxClass'. Additionally, only policy values that represent the strings 'IN' and 'OUT' SHOULD be used with pcelsFlowDirectionVariableAuxClass instances.

5.16. The Auxiliary Class pcelsValueAuxClass ✨

okay so pcelsValueAuxClass is the base class for representing a policy value 💖 It gets mapped from the PolicyValue class [PCIM_EXT]. It's an auxiliary object class, and it's derived directly from the 'top' object class [LDAP_SCHEMA] 🎀

Heads up: this class doesn't hold actual values. Its subclasses are the ones that bring the real values 🦋 What pcelsValueAuxClass does is set up the "policy value" semantics that every subclass inherits, including the ability to represent either rule-specific or reusable policy values 🧚

To keep rule-specific and reusable values possible, all the subclasses of pcelsValueAuxClass MUST also be auxiliary classes 🔥

Here's the class definition:

( 1.3.6.1.1.9.1.40
  NAME 'pcelsValueAuxClass'
  DESC 'Base class for representing a policy value'
  SUP top
  AUXILIARY
  MAY ( pcelsValueName )
)

The pcelsValueName attribute type can be used as the naming attribute for pcelsValueAuxClass entries 💅 Its syntax is Directory String [LDAP_SYNTAX], with a caseIgnoreMatch equality rule, a caseIgnoreOrderingMatch ordering rule, and a caseIgnoreSubstringsMatch substrings rule [LDAP_SYNTAX]. Attributes of this type can only have a single value 🌸

Here's how it's defined:

( 1.3.6.1.1.9.2.19
  NAME 'pcelsValueName'
  DESC 'The user-friendly name of a value'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
)

5.17. The Subclasses of pcelsValueAuxClass 🌈

the following classes are all derived from pcelsValueAuxClass, and they're mapped from the matching subclasses of the PolicyValue class [PCIM_EXT]. Every class below is an auxiliary object class 💜

pcelsIPv4AddrValueAuxClass is for a policy value that gives you an unordered set of IPv4 addresses, IPv4 address ranges, or hosts 🌐 It's mapped from the PolicyIPv4AddrValue class [PCIM_EXT].

( 1.3.6.1.1.9.1.41
  NAME 'pcelsIPv4AddrValueAuxClass'
  DESC 'Provides IPv4 addresses'
  SUP pcelsValueAuxClass
  AUXILIARY
  MUST ( pcelsIPv4AddrList )
)

pcelsIPv4AddrList is the attribute type that holds that unordered set of IPv4 addresses, ranges, or hosts 🫶 It's mapped from the PolicyIPv4AddrValue.IPv4AddrList property [PCIM_EXT]. Its syntax is Directory String [LDAP_SYNTAX], with caseIgnoreMatch equality, caseIgnoreOrderingMatch ordering, and caseIgnoreSubstringsMatch substrings matching [LDAP_SYNTAX]. It can have multiple values, and the only values allowed are strings that match one of the formats defined for the IPv4AddrList property [PCIM_EXT] ✨

( 1.3.6.1.1.9.2.20
  NAME 'pcelsIPv4AddrList'
  DESC 'Unordered set of IPv4 addresses, IPv4 address ranges or
        hosts'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)

pcelsIPv6AddrValueAuxClass is the IPv6 version: a policy value that gives you an unordered set of IPv6 addresses, IPv6 address ranges, or hosts 🍓 It's mapped from the PolicyIPv6AddrValue class [PCIM_EXT].

( 1.3.6.1.1.9.1.42
  NAME 'pcelsIPv6AddrValueAuxClass'
  DESC 'Provides IPv6 addresses'
  SUP pcelsValueAuxClass
  AUXILIARY
  MUST ( pcelsIPv6AddrList )
)

pcelsIPv6AddrList is the attribute type for that set of IPv6 addresses, ranges, or hosts 💖 It's mapped from the PolicyIPv6AddrValue.IPv6AddrList property [PCIM_EXT]. It uses Directory String [LDAP_SYNTAX], with caseIgnoreMatch equality, caseIgnoreOrderingMatch ordering, and caseIgnoreSubstringsMatch substrings [LDAP_SYNTAX]. It can hold multiple values, and they have to conform to one of the formats defined for the IPv6AddrList property [PCIM_EXT] 🦋

( 1.3.6.1.1.9.2.21
  NAME 'pcelsIPv6AddrList'
  DESC 'Unordered set of IPv6 addresses, IPv6 address ranges or
        hosts'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)

pcelsMACAddrValueAuxClass is for a policy value that gives you an unordered set of MAC addresses or MAC address ranges 🧚 It's mapped from the PolicyMACAddrValue class [PCIM_EXT].

( 1.3.6.1.1.9.1.43
  NAME 'pcelsMACAddrValueAuxClass'
  DESC 'Provides MAC addresses'
  SUP pcelsValueAuxClass
  AUXILIARY
  MUST ( pcelsMACAddrList )
)

pcelsMACAddrList is the attribute type for that set of MAC addresses or ranges 💜 It's mapped from the PolicyMACAddrValue.MACAddrList property [PCIM_EXT]. Its syntax is Directory String [LDAP_SYNTAX], with caseIgnoreMatch equality, caseIgnoreOrderingMatch ordering, and caseIgnoreSubstringsMatch substrings [LDAP_SYNTAX]. It can have multiple values, and they must match one of the formats defined for the MACAddrList property [PCIM_EXT] 🌸

( 1.3.6.1.1.9.2.22
  NAME 'pcelsMACAddrList'
  DESC 'Unordered set of MAC addresses or MAC address ranges'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)

pcelsStringValueAuxClass is for a policy value that gives you an unordered set of strings with wildcards 🎀 It's mapped from the PolicyStringValue class [PCIM_EXT].

( 1.3.6.1.1.9.1.44
  NAME 'pcelsStringValueAuxClass'
  DESC 'Provides string values'
  SUP pcelsValueAuxClass
  AUXILIARY
  MUST ( pcelsStringList )

)

pcelsStringList is the attribute type for that unordered set of wildcard strings ✨ It's mapped from the PolicyStringValue.StringList property [PCIM_EXT]. Its syntax is Directory String [LDAP_SYNTAX], with caseIgnoreMatch equality, caseIgnoreOrderingMatch ordering, and caseIgnoreSubstringsMatch substrings [LDAP_SYNTAX]. It can have multiple values, and they have to conform to the format defined for the StringList property [PCIM_EXT] 💅

( 1.3.6.1.1.9.2.23
  NAME 'pcelsStringList'
  DESC 'Unordered set of strings with wildcards'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)

pcelsBitStringValueAuxClass is for a policy value that gives you an unordered set of bit strings or bit string ranges 🦋 It's mapped from the PolicyBitStringValue class [PCIM_EXT].

( 1.3.6.1.1.9.1.45
  NAME 'pcelsBitStringValueAuxClass'
  DESC 'Provides bit strings'
  SUP pcelsValueAuxClass
  AUXILIARY
  MUST ( pcelsBitStringList )
)

pcelsBitStringList is the attribute type for that unordered set of bit strings or bit string ranges 🌈 It's mapped from the PolicyBitStringValue.BitStringList property [PCIM_EXT]. Its syntax is Directory String [LDAP_SYNTAX], with caseIgnoreMatch equality, caseIgnoreOrderingMatch ordering, and caseIgnoreSubstringsMatch substrings [LDAP_SYNTAX]. It can have multiple values, and they have to match one of the formats defined for the BitStringList property [PCIM_EXT] 🫶

( 1.3.6.1.1.9.2.24
  NAME 'pcelsBitStringList'
  DESC 'Unordered set of bit strings or bit string ranges'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)

pcelsIntegerValueAuxClass is for a policy value that gives you an unordered set of integers or integer ranges 🔥 It's mapped from the PolicyIntegerValue class [PCIM_EXT].

( 1.3.6.1.1.9.1.46
  NAME 'pcelsIntegerValueAuxClass'
  DESC 'Provides integer values'
  SUP pcelsValueAuxClass
  AUXILIARY
  MUST ( pcelsIntegerList )
)

pcelsIntegerList is the attribute type for that unordered set of integers or integer ranges 🍓 It's mapped from the PolicyIntegerValue.IntegerList property [PCIM_EXT]. Its syntax is Directory String [LDAP_SYNTAX], with caseIgnoreMatch equality, caseIgnoreOrderingMatch ordering, and caseIgnoreSubstringsMatch substrings [LDAP_SYNTAX]. It can have multiple values, and they have to conform to the format defined for the IntegerList property [PCIM_EXT] 💖

( 1.3.6.1.1.9.2.25
  NAME 'pcelsIntegerList'
  DESC 'Unordered set of integers or integer ranges'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)

pcelsBooleanValueAuxClass is for a policy value that gives you a boolean 👑 It's mapped from the PolicyIntegerValue class [PCIM_EXT].

( 1.3.6.1.1.9.1.47
  NAME 'pcelsBooleanValueAuxClass'
  DESC 'Provides a boolean value.'
  SUP pcelsValueAuxClass
  AUXILIARY
  MUST ( pcelsBoolean )
)

pcelsBoolean is the attribute type for the boolean itself 🧚 It's mapped from the PolicyBooleanValue.BooleanValue property [PCIM_EXT]. Its syntax is Boolean [LDAP_SYNTAX], with a booleanMatch equality rule [LDAP_MATCH]. Attributes of this type can only have a single value 🦋

( 1.3.6.1.1.9.2.26
  NAME 'pcelsBoolean'
  DESC 'Boolean value'
  EQUALITY booleanMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
  SINGLE-VALUE
)

5.18. The Three Reusable Policy Container Classes 🧺✨

okay bestie, the pcelsReusableContainer class is a container for reusable policy elements 💅 It's mapped from the ReusablePolicyContainer class [PCIM_EXT] and derived from the pcimRepository class [PCLS]. Since the goal is maximum flexibility, it's defined as abstract, so it never gets used directly 🦋 Instead there are two ways to use it: an auxiliary subclass called pcelsReusableContainerAuxClass lets you attach a reusable policy container to an entry that already exists, and a structural subclass called pcelsReusableContainerInstance lets the container show up as its own standalone entry 🌸

the elements inside a reusable policy container are aggregated through subordination to a pcelsReusableContainer instance (that's DIT containment, iykyk 🙈). a container can also include the elements of another reusable policy container by aggregating that container itself. this happens through DIT containment when the containers are subordinated to one another, or by reference when the aggregating container points at the other one using the attribute pcelsReusableContainerList ✨

the pcelsReusableContainer class is defined as follows:

   ( 1.3.6.1.1.9.1.48
     NAME 'pcelsReusableContainer'
     DESC 'Container for reusable policy information'
     SUP pcimRepository
     ABSTRACT
     MAY ( pcelsReusableContainerName
   $ pcelsReusableContainerList )
   )

the pcelsReusableContainerAuxClass class is defined as follows:

   ( 1.3.6.1.1.9.1.49
     NAME 'pcelsReusableContainerAuxClass '
     DESC 'Container for reusable policy information'
     SUP pcelsReusableContainer
     AUXILIARY
   )

the pcelsReusableContainerInstance class is defined as follows:

   ( 1.3.6.1.1.9.1.50
     NAME 'pcelsReusableContainerInstance'
     DESC 'Container for reusable policy information'
     SUP pcelsReusableContainer
     STRUCTURAL
   )

the pcelsReusableContainerName attribute type may be used as the naming attribute for pcelsReusableContainer entries 🎀 it's of syntax Directory String [LDAP_SYNTAX], with an equality matching rule of caseIgnoreMatch, an ordering matching rule of caseIgnoreOrderingMatch, and a substrings matching rule of caseIgnoreSubstringsMatch [LDAP_SYNTAX]. attributes of this type can only have a single value.

this attribute type is defined as follows:

   ( 1.3.6.1.1.9.2.27
     NAME 'pcelsReusableContainerName'
     DESC 'User-friendly name of a reusable policy container'
     EQUALITY caseIgnoreMatch
     ORDERING caseIgnoreOrderingMatch
     SUBSTR caseIgnoreSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE
   )

the pcelsReusableContainerList attribute type realizes the ContainedDomain association [PCIM_EXT] 🔗 it's of syntax DN [LDAP_SYNTAX], with an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX], and attributes of this type can have multiple values. the only allowed values for pcelsReusableContainerList attributes are DNs of pcelsReusableContainer entries. inside a pcelsReusableContainer, this attribute represents the associations between that container and others, for the purpose of including them as nested containers 🪆

this attribute type is defined as follows:

   ( 1.3.6.1.1.9.2.28
     NAME 'pcelsReusableContainerList'
     DESC 'Unordered set of DNs of pcelsReusableContainer entries'
     EQUALITY distinguishedNameMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
   )

Note: PCELS implementations SHOULD support pcelsReusableContainer and its two subclasses and MAY also support the two subclasses of pcimRepository [PCLS] 💜

5.19. The Structural Class pcelsRoleCollection 👑

the pcelsRoleCollection class represents a collection of managed elements that all share a common role 🌈 it's mapped from the PolicyRoleCollection class [PCIM_EXT]. it's a structural object class, and it's derived from the pcimPolicy class [PCLS].

the pcelsRoleCollection class is defined as follows:

   ( 1.3.6.1.1.9.1.51
     NAME 'pcelsRoleCollection'
     DESC 'Collection of managed elements that share a common role'
     SUP pcimPolicy
     STRUCTURAL
     MUST ( pcelsRole )
     MAY ( pcelsRoleCollectionName
   $ pcelsElementList )
   )

the pcelsRole attribute type represents the role associated with a collection of managed elements 🎭 it's mapped from the PolicyRoleCollection.PolicyRole property [PCIM_EXT]. this attribute type is of syntax Directory String [LDAP_SYNTAX], with an equality matching rule of caseIgnoreMatch, an ordering matching rule of caseIgnoreOrderingMatch, and a substrings matching rule of caseIgnoreSubstringsMatch [LDAP_SYNTAX]. attributes of this type can only have a single value.

this attribute type is defined as follows:

   ( 1.3.6.1.1.9.2.29
     NAME 'pcelsRole'
     DESC 'String representing a role.'
     EQUALITY caseIgnoreMatch
     ORDERING caseIgnoreOrderingMatch
     SUBSTR caseIgnoreSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE
   )

the pcelsRoleCollectionName attribute type may be used as the naming attribute for pcelsRoleCollection entries 🌷 it's of syntax Directory String [LDAP_SYNTAX], with an equality matching rule of caseIgnoreMatch, an ordering matching rule of caseIgnoreOrderingMatch, and a substrings matching rule of caseIgnoreSubstringsMatch [LDAP_SYNTAX]. attributes of this type can only have a single value.

this attribute type is defined as follows:

   ( 1.3.6.1.1.9.2.30
     NAME 'pcelsRoleCollectionName'
     DESC 'User-friendly name of a role collection'
     EQUALITY caseIgnoreMatch
     ORDERING caseIgnoreOrderingMatch
     SUBSTR caseIgnoreSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE
   )

the pcelsElementList attribute type realizes the ElementInPolicyRoleCollection association [PCIM_EXT] 🧩 it's of syntax DN [LDAP_SYNTAX], with an equality matching rule of distinguishedNameMatch [LDAP_SYNTAX], and attributes of this type can have multiple values. inside a pcelsRoleCollection, the pcelsElementList attribute represents the associations between that role collection and its members.

this attribute type is defined as follows:

   ( 1.3.6.1.1.9.2.31
     NAME 'pcelsElementList'
     DESC 'Unordered set of managed elements'
     EQUALITY distinguishedNameMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
   )

5.20. The Abstract Class pcelsFilterEntryBase 🔍

the pcelsFilterEntryBase class is the base class for defining message or packet filters 💖 it's mapped from the FilterEntryBase class [PCIM_EXT]. it's an abstract object class, and it's derived from the pcimPolicy class [PCLS].

the pcelsFilterEntryBase class is defined as follows:

   ( 1.3.6.1.1.9.1.52
     NAME 'pcelsFilterEntryBase'
     DESC 'Base class for message or packet filters'
     SUP pcimPolicy
     ABSTRACT
     MAY ( pcelsFilterName
         $ pcelsFilterIsNegated )
   )

the pcelsFilterName attribute type may be used as the naming attribute for pcelsFilterEntryBase entries 🏷️ it's of syntax Directory String [LDAP_SYNTAX], with an equality matching rule of caseIgnoreMatch, an ordering matching rule of caseIgnoreOrderingMatch, and a substrings matching rule of caseIgnoreSubstringsMatch [LDAP_SYNTAX]. attributes of this type can only have a single value.

this attribute type is defined as follows:

   ( 1.3.6.1.1.9.2.32
     NAME 'pcelsFilterName'
     DESC 'User-friendly name of a filter entry'
     EQUALITY caseIgnoreMatch
     ORDERING caseIgnoreOrderingMatch
     SUBSTR caseIgnoreSubstringsMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
     SINGLE-VALUE
   )

the pcelsFilterIsNegated attribute type indicates whether the match information specified in a pcelsFilterEntryBase is negated or not 🙃

it's mapped from the FilterEntryBase.IsNegated property [PCIM_EXT]. this attribute type is of syntax Boolean [LDAP_SYNTAX], with an equality matching rule of booleanMatch [LDAP_MATCH]. attributes of this type can only have a single value. if this attribute is missing from a pcelsFilterEntryBase instance, applications MUST assume that the filter is not negated 🫶

this attribute type is defined as follows:

   ( 1.3.6.1.1.9.2.33
     NAME 'pcelsFilterIsNegated'
     DESC 'Indicates whether the filter is negated'
     EQUALITY booleanMatch
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
     SINGLE-VALUE
   )

5.21. The Structural Class pcelsIPHeadersFilter 🦋

the pcelsIPHeadersFilter class gives you the most commonly needed attributes for filtering on IP, TCP or UDP headers 🌸 it's mapped from the IpHeadersFilter class [PCIM_EXT], and it's a structural object class derived from the pcelsFilterEntryBase class.

the pcelsIPHeadersFilter class is defined as follows:

   ( 1.3.6.1.1.9.1.53
     NAME 'pcelsIPHeadersFilter'
     DESC 'IP header filter'
     SUP pcelsFilterEntryBase
     STRUCTURAL
     MAY ( pcelsIPHdrVersion
         $ pcelsIPHdrSourceAddress
         $ pcelsIPHdrSourceAddressEndOfRange
         $ pcelsIPHdrSourceMask
         $ pcelsIPHdrDestAddress
         $ pcelsIPHdrDestAddressEndOfRange
         $ pcelsIPHdrDestMask
         $ pcelsIPHdrProtocolID
         $ pcelsIPHdrSourcePortStart
         $ pcelsIPHdrSourcePortEnd
         $ pcelsIPHdrDestPortStart
         $ pcelsIPHdrDestPortEnd
         $ pcelsIPHdrDSCPList
         $ pcelsIPHdrFlowLabel )
   )

Applications MUST assume 'all values' for optional (MAY) attributes not present in a pcelsIPHeadersFilter entry 🌈

[PCIM_EXT] defines several constraints for the IpHeadersFilter class and its properties 📜 all of these constraints apply to the pcelsIPHeadersFilter class and its attributes, even the ones this document doesn't bother repeating for brevity. a pcelsIPHeadersFilter entry that violates any of these constraints SHOULD be treated as invalid, and the policy rules or groups associated with that entry SHOULD be treated as being disabled, meaning that executing those policy rules or groups SHOULD be stopped 💀

the pcelsIPHdrVersion attribute type indicates the version of the IP addresses to be filtered on 🌐 it's mapped from the IpHeadersFilter.HdrIpVersion property [PCIM_EXT]. this attribute type is of syntax Integer [LDAP_SYNTAX], with an equality matching rule of integerMatch [LDAP_SYNTAX] and an ordering matching rule of integerOrderingMatch [LDAP_MATCH]. attributes of this type can only have a single value. the only allowed values for attributes of this type are 4 and 6.

in a pcelsIPHeadersFilter entry, the pcelsIPHdrVersion attribute type determines the size of the IP version dependent attribute values 🧠 those attributes are: pcelsIPHdrSourceAddress, pcelsIPHdrSourceAddressEndOfRange, pcelsIPHdrSourceMask, pcelsIPHdrDestAddress, pcelsIPHdrDestAddressEndOfRange and pcelsIPHdrDestMask. their valid values are as follows:

  • for IPv4: OctetStrings with a size of 4
  • for IPv6: OctetStrings with a size of 16 or 20

if the pcelsIPHdrVersion attribute is missing from a pcelsFilterEntryBase instance, then the filter does not consider the IP version when selecting matching packets 🙈 in that case, the IP version dependent attributes (listed above) must not be present in the filter entry.

this attribute type is defined as follows:

okay bestie, the IP header attributes are here and they are SO organised 🎀 First up is the one for the IP version, which we already met. It's the thing that tells you which IP version the header is using, so you know which address format to expect ✨

( 1.3.6.1.1.9.2.34
  NAME 'pcelsIPHdrVersion'
  DESC 'IP version'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

Next is pcelsIPHdrSourceAddress 💜 It holds a source IP address, and it's mapped from the IpHeadersFilter.HdrSrcAddress property [PCIM_EXT]. The syntax is OctetString [LDAP_SYNTAX], with an equality matching rule of octetStringMatch [LDAP_SCHEMA] and an ordering matching rule of octetStringOrderingMatch [LDAP_MATCH]. It only ever holds one value, and the only allowed values are octet strings of size 4, 16, or 20 🦋

( 1.3.6.1.1.9.2.35
  NAME 'pcelsIPHdrSourceAddress'
  DESC 'Source IP address'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

Now pcelsIPHdrSourceAddressEndOfRange 🌸 This one represents the end of a range of source IP addresses, and it's mapped from IpHeadersFilter.HdrSrcAddressEndOfRange [PCIM_EXT]. Same deal as before: OctetString syntax [LDAP_SYNTAX], octetStringMatch for equality [LDAP_SCHEMA], octetStringOrderingMatch for ordering [LDAP_MATCH], single value only, and the allowed values are octet strings of size 4, 16, or 20 🍓

( 1.3.6.1.1.9.2.36
  NAME 'pcelsIPHdrSourceAddressEndOfRange'
  DESC 'End of a range of source IP addresses'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

Then there's pcelsIPHdrSourceMask 🧚 It's the mask used when comparing the source IP address, and it's mapped from IpHeadersFilter.HdrSrcMask [PCIM_EXT]. It's OctetString syntax [LDAP_SYNTAX], with octetStringMatch [LDAP_SCHEMA] for equality and octetStringOrderingMatch [LDAP_MATCH] for ordering. Single value, and the allowed values are octet strings of size 4, 16, or 20 💅

( 1.3.6.1.1.9.2.37
  NAME 'pcelsIPHdrSourceMask'
  DESC 'Mask to be used in comparing the source IP address'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

Moving on to the destination side with pcelsIPHdrDestAddress 🦋 This one represents a destination IP address, mapped from IpHeadersFilter.HdrDestAddress [PCIM_EXT]. OctetString syntax [LDAP_SYNTAX], octetStringMatch for equality [LDAP_SCHEMA], octetStringOrderingMatch for ordering [LDAP_MATCH], single value, and octet strings of size 4, 16, or 20 are the only allowed values ✨

( 1.3.6.1.1.9.2.38
  NAME 'pcelsIPHdrDestAddress'
  DESC 'Destination IP address'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

pcelsIPHdrDestAddressEndOfRange 🎀 represents the end of a range of destination IP addresses, mapped from IpHeadersFilter.HdrDestAddressEndOfRange [PCIM_EXT]. Same vibe as its source twin: OctetString syntax [LDAP_SYNTAX], octetStringMatch [LDAP_SCHEMA] for equality, octetStringOrderingMatch [LDAP_MATCH] for ordering, single value, and size 4, 16, or 20 octet strings only 🌈

( 1.3.6.1.1.9.2.39
  NAME 'pcelsIPHdrDestAddressEndOfRange'
  DESC 'End of a range of destination IP addresses'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

pcelsIPHdrDestMask 💜 is the mask used in comparing the destination IP address, mapped from IpHeadersFilter.HdrDestMask [PCIM_EXT]. It's OctetString syntax [LDAP_SYNTAX], with octetStringMatch [LDAP_SCHEMA] for equality and octetStringOrderingMatch [LDAP_MATCH] for ordering. Single value, and the allowed values are octet strings of size 4, 16, or 20 🍓

( 1.3.6.1.1.9.2.40
  NAME 'pcelsIPHdrDestMask'
  DESC 'Mask to be used in comparing the destination IP address'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

Now for the protocol. pcelsIPHdrProtocolID 🧚 indicates an IP protocol type, and it's mapped from IpHeadersFilter.HdrProtocolID [PCIM_EXT]. This one is Integer syntax [LDAP_SYNTAX], with integerMatch [LDAP_SYNTAX] for equality and integerOrderingMatch [LDAP_MATCH] for ordering. Single value, and the allowed values are integers in the range 0..255 (inclusive) 🔥

( 1.3.6.1.1.9.2.41
  NAME 'pcelsIPHdrProtocolID'
  DESC 'IP protocol type'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

Ports are next, and they're giving range vibes 🌸 pcelsIPHdrSourcePortStart represents the lower end of a range of UDP or TCP source ports, and it's mapped from IpHeadersFilter.HdrSrcPortStart [PCIM_EXT]. It's Integer syntax [LDAP_SYNTAX], with integerMatch [LDAP_SYNTAX] for equality and integerOrderingMatch [LDAP_MATCH] for ordering. Single value, and the allowed values are integers in the range 0..65535 (inclusive) 💖

( 1.3.6.1.1.9.2.42
  NAME 'pcelsIPHdrSourcePortStart'
  DESC 'Lower end of a range of UDP or TCP source ports'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

pcelsIPHdrSourcePortEnd is the upper end of that same kind of range of UDP or TCP source ports, mapped from IpHeadersFilter.HdrSrcPortEnd [PCIM_EXT]. Integer syntax [LDAP_SYNTAX], integerMatch [LDAP_SYNTAX] for equality, integerOrderingMatch [LDAP_MATCH] for ordering, single value, and integers from 0 to 65535 (inclusive) are allowed 🦋

( 1.3.6.1.1.9.2.43
  NAME 'pcelsIPHdrSourcePortEnd'
  DESC 'Upper end of a range of UDP or TCP source ports'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

And now the destination ports 🎀 pcelsIPHdrDestPortStart is the lower end of a range of UDP or TCP destination ports, mapped from IpHeadersFilter.HdrDestPortStart [PCIM_EXT]. Integer syntax [LDAP_SYNTAX], integerMatch [LDAP_SYNTAX] for equality, integerOrderingMatch [LDAP_MATCH] for ordering, single value, and the allowed values are integers in the range 0..65535 (inclusive) 👑

( 1.3.6.1.1.9.2.44
  NAME 'pcelsIPHdrDestPortStart'
  DESC 'Lower end of a range of UDP or TCP destination ports'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

pcelsIPHdrDestPortEnd is the upper end of that range of UDP or TCP destination ports, mapped from IpHeadersFilter.HdrDestPortEnd [PCIM_EXT]. It's Integer syntax [LDAP_SYNTAX], with integerMatch [LDAP_SYNTAX] for equality and integerOrderingMatch [LDAP_MATCH] for ordering. Single value, and integers in the range 0..65535 (inclusive) are the only allowed values 💜

( 1.3.6.1.1.9.2.45
  NAME 'pcelsIPHdrDestPortEnd'
  DESC 'Upper end of a range of UDP or TCP destination ports'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

Here's one that's different, bestie 👀 pcelsIPHdrDSCPList is mapped from IpHeadersFilter.HdrDSCP [PCIM_EXT]. It's Integer syntax [LDAP_SYNTAX], with integerMatch [LDAP_SYNTAX] for equality and integerOrderingMatch [LDAP_MATCH] for ordering. It can have multiple values 🌈, and the allowed values are integers in the range 0..63 (inclusive). Notice there's no SINGLE-VALUE in its definition, which is the whole point ✨

( 1.3.6.1.1.9.2.46
  NAME 'pcelsIPHdrDSCPList'
  DESC 'DSCP values'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
)

Last but not least, pcelsIPHdrFlowLabel 🧚 is mapped from IpHeadersFilter.HdrFlowLabel [PCIM_EXT]. It's OctetString syntax [LDAP_SYNTAX], with octetStringMatch [LDAP_SCHEMA] for equality and octetStringOrderingMatch [LDAP_MATCH] for ordering. Single value, and the only allowed values are octet strings of size 3 (that is, 24 bits) that contain a Flow Label value in the rightmost 20 bits, padded on the left with b'0000' 🦋

( 1.3.6.1.1.9.2.47
  NAME 'pcelsIPHdrFlowLabel'
  DESC 'IP flow label'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE

)

5.22. The Structural Class pcels8021Filter ✨

okay so the pcels8021Filter class is where we get our 802.1 attributes for filtering on 802.1 headers 🎀 It's mapped from the 8021Filter class [PCIM_EXT], and it's a structural object class that's derived from pcelsFilterEntryBase 💅

The class is defined like this:

( 1.3.6.1.1.9.1.54
  NAME 'pcels8021Filter'
  DESC '802.1 header filter'
  SUP pcelsFilterEntryBase
  STRUCTURAL
  MAY ( pcels8021HdrSourceMACAddress
      $ pcels8021HdrSourceMACMask
      $ pcels8021HdrDestMACAddress
      $ pcels8021HdrDestMACMask
      $ pcels8021HdrProtocolID
      $ pcels8021HdrPriority
      $ pcels8021HdrVLANID )
)

Applications MUST assume 'all values' for optional (MAY) attributes not present in a pcels8021Filter entry. 🌸

[PCIM_EXT] defines a bunch of constraints for the 8021Filter class and its properties, and ALL of them count (even the ones that aren't repeated here for brevity) 🫶 They apply to pcels8021Filter and its attributes. Now, if a pcels8021Filter entry breaks any of these constraints, it SHOULD be treated as invalid. The policy rules or groups tied to that entry SHOULD be treated as disabled, which means running those policy rules or groups SHOULD be stopped. 😭 Lowkey dramatic, but it keeps things safe 🔥

The pcels8021HdrSourceMACAddress attribute type represents a source MAC address 🦋 It's mapped from the 8021Filter.8021HdrSrcMACAddr property [PCIM_EXT]. Its syntax is OctetString [LDAP_SYNTAX], it uses the octetStringMatch equality matching rule [LDAP_SCHEMA] and the octetStringOrderingMatch ordering matching rule [LDAP_MATCH]. It's single-valued, and the only allowed values are octet strings with a size of 6 🍓

( 1.3.6.1.1.9.2.48
  NAME 'pcels8021HdrSourceMACAddress'
  DESC 'Source MAC address'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

The pcels8021HdrSourceMACMask attribute type represents a mask used when comparing the source MAC address 🧚 It's mapped from the 8021Filter.8021HdrSrcMACMask property [PCIM_EXT]. Same deal as before: OctetString syntax [LDAP_SYNTAX], octetStringMatch [LDAP_SCHEMA] for equality, octetStringOrderingMatch [LDAP_MATCH] for ordering, single value only, and octet strings of size 6 only 💜

( 1.3.6.1.1.9.2.49
  NAME 'pcels8021HdrSourceMACMask'
  DESC 'Source MAC address mask'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

The pcels8021HdrDestMACAddress attribute type represents a destination MAC address 💖 It's mapped from the 8021Filter.8021HdrDestMACAddr property [PCIM_EXT]. It's OctetString syntax [LDAP_SYNTAX], with octetStringMatch [LDAP_SCHEMA] for equality and octetStringOrderingMatch [LDAP_MATCH] for ordering. One value max, and it has to be an octet string of size 6 ✨

( 1.3.6.1.1.9.2.50
  NAME 'pcels8021HdrDestMACAddress'
  DESC 'Destination MAC address'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

The pcels8021HdrDestMACMask attribute type represents a mask used when comparing the destination MAC address 🎀 It's mapped from the 8021Filter.8021HdrDestMACMask property [PCIM_EXT]. Syntax is OctetString [LDAP_SYNTAX], equality is octetStringMatch [LDAP_SCHEMA], ordering is octetStringOrderingMatch [LDAP_MATCH], it's single-valued, and the only allowed values are octet strings of size 6 🦋

( 1.3.6.1.1.9.2.51
  NAME 'pcels8021HdrDestMACMask'
  DESC 'Destination MAC address mask'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
  SINGLE-VALUE
)

The pcels8021HdrProtocolID attribute type indicates an Ethernet protocol type 🌈 It's mapped from the 8021Filter.8021HdrProtocolID property [PCIM_EXT]. This one is Integer syntax [LDAP_SYNTAX], with integerMatch [LDAP_SYNTAX] for equality and integerOrderingMatch [LDAP_MATCH] for ordering. It can have multiple values, no order is implied (so it's a vibe, not a list 🙈), and the only allowed values are integers from 0 to 65535 inclusive 👑

( 1.3.6.1.1.9.2.52
  NAME 'pcels8021HdrProtocolID'
  DESC 'Ethernet protocol ID'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
)

The pcels8021HdrPriority attribute type indicates an 802.1Q priority 💅 It's mapped from the 8021Filter.8021HdrPriorityValue property [PCIM_EXT]. Integer syntax [LDAP_SYNTAX], integerMatch [LDAP_SYNTAX] for equality, integerOrderingMatch [LDAP_MATCH] for ordering. Multiple values are fine, no order is implied, and the allowed values are integers from 0 to 7 inclusive 🍓

( 1.3.6.1.1.9.2.53
  NAME 'pcels8021HdrPriority'
  DESC '802.1Q priority'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
)

The pcels8021HdrVLANID attribute type indicates an 802.1Q VLAN Identifier 🌸 It's mapped from the 8021Filter.8021HdrVLANID property [PCIM_EXT]. Integer syntax [LDAP_SYNTAX], integerMatch [LDAP_SYNTAX] for equality, integerOrderingMatch [LDAP_MATCH] for ordering. Multiple values allowed, and the only allowed values are integers from 0 to 4095 inclusive 🧚

( 1.3.6.1.1.9.2.54
  NAME 'pcels8021HdrVLANID'
  DESC '802.1Q VLAN ID'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
)

5.23. The Auxiliary Class pcelsFilterListAuxClass 🦋

okay so pcelsFilterListAuxClass is basically a collection of device-level filters that get bundled together in a policy condition 💜 It's mapped from the FilterList class [PCIM_EXT]. You can use these instances as conditions in policy rules, or as parts of compound conditions. It's an auxiliary object class, and it's derived from the pcimConditionAuxClass class [PCLS] 💅

The class is defined like this:

( 1.3.6.1.1.9.1.55
  NAME 'pcelsFilterListAuxClass'
  DESC 'Collection of pcelsFilterEntryBase filters'
  SUP pcimConditionAuxClass
  AUXILIARY
  MAY ( pcelsFilterListName
      $ pcelsFilterDirection
      $ pcelsFilterEntryList )
)

The pcelsFilterListName attribute type may be used as the naming attribute for pcelsFilterListAuxClass entries 🎀 Its syntax is Directory String [LDAP_SYNTAX], it uses caseIgnoreMatch for equality, caseIgnoreOrderingMatch for ordering, and caseIgnoreSubstringsMatch for substrings [LDAP_SYNTAX]. It's single-valued.

( 1.3.6.1.1.9.2.55
  NAME 'pcelsFilterListName'
  DESC 'User-friendly name of a FilterList'
  EQUALITY caseIgnoreMatch
  ORDERING caseIgnoreOrderingMatch
  SUBSTR caseIgnoreSubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
)

The pcelsFilterDirection attribute type indicates which direction the packets or messages are going, relative to the interface where the filter is applied 🌈 It's mapped from the FilterList.Direction property [PCIM_EXT]. Integer syntax [LDAP_SYNTAX], integerMatch [LDAP_SYNTAX] for equality, integerOrderingMatch [LDAP_MATCH] for ordering. It's single-valued, and the only allowed values are 0 (NotApplicable), 1 (Input), 2 (Output), 3 (Both) and 4 (Mirrored) ✨ If this attribute is missing from a pcelsFilterListAuxClass instance, applications MUST assume that a direction is not applicable 🙈

( 1.3.6.1.1.9.2.56
  NAME 'pcelsFilterDirection'
  DESC 'Direction to which this filter is applied'
  EQUALITY integerMatch
  ORDERING integerOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE
)

The pcelsFilterEntryList attribute type realizes the EntriesInFilterList association [PCIM_EXT] 🦋 Its syntax is DN [LDAP_SYNTAX] and it uses distinguishedNameMatch [LDAP_SYNTAX] for equality. Multiple values are allowed, and the only allowed values are DNs of pcelsFilterEntryBase entries. In a pcelsFilterListAuxClass, this attribute is what represents the associations between the filter collection and its components 💖

( 1.3.6.1.1.9.2.57
  NAME 'pcelsFilterEntryList'
  DESC 'Unordered set of DNs of pcelsFilterEntryBase entries'
  EQUALITY distinguishedNameMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)

The EntrySequence property of the EntriesInFilterList association is restricted to a single value ('0') [PCIM_EXT], which makes it redundant 🥺 So there's no need to map it to an LDAP schema element. Not every property needs its own schema moment, bestie 🌸

5.24. The Auxiliary Class pcelsVendorVariableAuxClass

okay bestie, so pcelsVendorVariableAuxClass is the catch-all for policy variables nobody has given their own proper class yet 💅 instead of a dedicated set of attributes, it uses two properties to describe what the variable holds and what format it's in. it's built for vendor-specific stuff that doesn't fit pcelsVariable, so standardized extensions SHOULD NOT use it 🫶

this class is an auxiliary object class, and it's derived from pcelsVariable ✨ here's how it's defined:

( 1.3.6.1.1.9.1.56
  NAME 'pcelsVendorVariableAuxClass'
  DESC 'Defines registered means to describe a policy variable'
  SUP pcelsVariable
  AUXILIARY
  MAY ( pcelsVendorVariableData $
        pcelsVendorVariableEncoding )
)

the pcelsVendorVariableData attribute is the "anything goes" slot 🎀 it holds policy variables that haven't been specifically modeled. it's of syntax OctetString [LDAP_SYNTAX], with an equality matching rule of octetStringMatch [LDAP_SCHEMA] and an ordering matching rule of octetStringOrderingMatch [LDAP_MATCH]. you can have multiple values here, and the format of each value is identified by the OID stored in pcelsVendorVariableEncoding 🦋

( 1.3.6.1.1.9.2.58
  NAME 'pcelsVendorVariableData'
  DESC 'Mechanism for representing variables that have not
        been specifically modeled'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
)

and pcelsVendorVariableEncoding is the label that tells you how to read the data 🧚 it's of syntax OID [LDAP_SYNTAX], uses an equality matching rule of objectIdentifierMatch [LDAP_SYNTAX], and can only have a single value. in pcelsVendorVariableAuxClass instances, it's the thing that identifies the format and semantics for the pcelsVendorVariableData values 💜

( 1.3.6.1.1.9.2.59
  NAME 'pcelsVendorVariableEncoding'
  DESC 'Identifies the format and semantics for policy variables'
  EQUALITY objectIdentifierMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.38
  SINGLE-VALUE
)

5.25. The Auxiliary Class pcelsVendorValueAuxClass

this one is the twin of the last class, just for policy values instead of variables 🌸 same deal: a general extension mechanism for values that haven't been specifically modeled, using two properties to define the content and format. it's for vendor-specific extensions that aren't a good fit for pcelsValueAuxClass, so standardized extensions SHOULD NOT use it either 🙈

it's an auxiliary object class derived from pcelsValueAuxClass, defined like this:

( 1.3.6.1.1.9.1.57
  NAME 'pcelsVendorValueAuxClass'
  DESC 'Defines registered means to describe a policy value'
  SUP pcelsValueAuxClass
  AUXILIARY
  MAY ( pcelsVendorValueData $
        pcelsVendorValueEncoding )
)

pcelsVendorValueData is the open-ended slot for policy values that haven't been specifically modeled 🍓 it's of syntax OctetString [LDAP_SYNTAX], with an equality matching rule of octetStringMatch [LDAP_SCHEMA] and an ordering matching rule of octetStringOrderingMatch [LDAP_MATCH]. multiple values are allowed, and the format of each one is identified by the OID in pcelsVendorValueEncoding 🌈

( 1.3.6.1.1.9.2.60
  NAME 'pcelsVendorValueData'
  DESC 'Mechanism for representing values that have not
        been specifically modeled'
  EQUALITY octetStringMatch
  ORDERING octetStringOrderingMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
)

pcelsVendorValueEncoding is the format label for those values 🧁 it's of syntax OID [LDAP_SYNTAX], uses an equality matching rule of objectIdentifierMatch [LDAP_SYNTAX], and can only hold a single value. in pcelsVendorVarlueAuxClass instances, it's used to identify the format and semantics for the pcelsVendorValueData attribute values ✨

( 1.3.6.1.1.9.2.61
  NAME 'pcelsVendorValueEncoding'
  DESC 'Identifies the format and semantics for policy values'
  EQUALITY objectIdentifierMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.38
  SINGLE-VALUE
)

6. Security Considerations 🔒

okay this section is short but it's giving "read the other doc" energy 💀 the Policy Core LDAP Schema [PCLS] covers the general security considerations for the core policy schema. the extensions defined in this document don't add any new security considerations of their own, so the core schema's guidance is the one to follow 🫶

7. IANA Considerations 🦋

for the LDAP side of things, you just refer to RFC 3383, "Internet Assigned Numbers Authority (IANA) Considerations for the Lightweight Directory Access Protocol (LDAP)" [LDAP-IANA] 💜

7.1. Object Identifiers

the IANA registered an LDAP Object Identifier for this spec, and the request followed this template 🎀

Subject: Request for LDAP OID Registration
Person & e-mail address to contact for further information:
Mircea Pana (mpana@metasolv.com)
Specification: RFC 4104
Author/Change Controller: IESG
Comments:
   The assigned OID is used as a base for identifying
   a number of schema elements defined in this document.

and the result? IANA assigned the OID 1.3.6.1.1.9 with the name pcelsSchema, recorded in the following registry 👑

http://www.iana.org/assignments/smi-numbers

7.2. Object Identifier Descriptors ✨

okay so the IANA has already registered the LDAP Descriptors used in this spec 💅 the request is written up as a template, and it's giving very organized energy:

Subject: Request for LDAP Descriptor Registration Update
Descriptor (short name): see comment
Object Identifier: see comment
Person & e-mail address to contact for further information:
   Mircea Pana (mpana@metasolv.com)
Usage: see comment
Specification: RFC 4104
Author/Change Controller: IESG
Comments:

Under Comments, the following descriptors were added 🦋 Here's the full list, with the OIDs next to each one:

NAME                                    Type  OID
--------------                          ----  ------------
pcelsPolicySet                           O     1.3.6.1.1.9.1.1
pcelsPolicySetAssociation                O     1.3.6.1.1.9.1.2
pcelsGroup                               O     1.3.6.1.1.9.1.3
pcelsGroupAuxClass                       O     1.3.6.1.1.9.1.4
pcelsGroupInstance                       O     1.3.6.1.1.9.1.5
pcelsRule                                O     1.3.6.1.1.9.1.6
pcelsRuleAuxClass                        O     1.3.6.1.1.9.1.7
pcelsRuleInstance                        O     1.3.6.1.1.9.1.8
pcelsConditionAssociation                O     1.3.6.1.1.9.1.9
pcelsActionAssociation                   O     1.3.6.1.1.9.1.10
pcelsSimpleConditionAuxClass             O     1.3.6.1.1.9.1.11
pcelsCompoundConditionAuxClass           O     1.3.6.1.1.9.1.12
pcelsCompoundFilterConditionAuxClass     O     1.3.6.1.1.9.1.13
pcelsSimpleActionAuxClass                O     1.3.6.1.1.9.1.14
pcelsCompoundActionAuxClass              O     1.3.6.1.1.9.1.15
pcelsVariable                            O     1.3.6.1.1.9.1.16
pcelsExplicitVariableAuxClass            O     1.3.6.1.1.9.1.17
pcelsImplicitVariableAuxClass            O     1.3.6.1.1.9.1.18
pcelsSourceIPv4VariableAuxClass          O     1.3.6.1.1.9.1.19
pcelsSourceIPv6VariableAuxClass          O     1.3.6.1.1.9.1.20
pcelsDestinationIPv4VariableAuxClass     O     1.3.6.1.1.9.1.21
pcelsDestinationIPv6VariableAuxClass     O     1.3.6.1.1.9.1.22
pcelsSourcePortVariableAuxClass          O     1.3.6.1.1.9.1.23
pcelsDestinationPortVariableAuxClass     O     1.3.6.1.1.9.1.24
pcelsIPProtocolVariableAuxClass          O     1.3.6.1.1.9.1.25
pcelsIPVersionVariableAuxClass           O     1.3.6.1.1.9.1.26
pcelsIPToSVariableAuxClass               O     1.3.6.1.1.9.1.27
pcelsDSCPVariableAuxClass                O     1.3.6.1.1.9.1.28
pcelsFlowIdVariableAuxClass              O     1.3.6.1.1.9.1.29
pcelsSourceMACVariableAuxClass           O     1.3.6.1.1.9.1.30
pcelsDestinationMACVariableAuxClass      O     1.3.6.1.1.9.1.31
pcelsVLANVariableAuxClass                O     1.3.6.1.1.9.1.32
pcelsCoSVariableAuxClass                 O     1.3.6.1.1.9.1.33
pcelsEthertypeVariableAuxClass           O     1.3.6.1.1.9.1.34
pcelsSourceSAPVariableAuxClass           O     1.3.6.1.1.9.1.35
pcelsDestinationSAPVariableAuxClass      O     1.3.6.1.1.9.1.36
pcelsSNAPOUIVariableAuxClass             O     1.3.6.1.1.9.1.37
pcelsSNAPTypeVariableAuxClass            O     1.3.6.1.1.9.1.38
pcelsFlowDirectionVariableAuxClass       O     1.3.6.1.1.9.1.39
pcelsValueAuxClass                       O     1.3.6.1.1.9.1.40
pcelsIPv4AddrValueAuxClass               O     1.3.6.1.1.9.1.41
pcelsIPv6AddrValueAuxClass               O     1.3.6.1.1.9.1.42
pcelsMACAddrValueAuxClass                O     1.3.6.1.1.9.1.43
pcelsStringValueAuxClass                 O     1.3.6.1.1.9.1.44
pcelsBitStringValueAuxClass              O     1.3.6.1.1.9.1.45
pcelsIntegerValueAuxClass                O     1.3.6.1.1.9.1.46
pcelsBooleanValueAuxClass                O     1.3.6.1.1.9.1.47
pcelsReusableContainer                   O     1.3.6.1.1.9.1.48
pcelsReusableContainerAuxClass           O     1.3.6.1.1.9.1.49
pcelsReusableContainerInstance           O     1.3.6.1.1.9.1.50
pcelsRoleCollection                      O     1.3.6.1.1.9.1.51
pcelsFilterEntryBase                     O     1.3.6.1.1.9.1.52
pcelsIPHeadersFilter                     O     1.3.6.1.1.9.1.53
pcels8021Filter                          O     1.3.6.1.1.9.1.54
pcelsFilterListAuxClass                  O     1.3.6.1.1.9.1.55
pcelsVendorVariableAuxClass              O     1.3.6.1.1.9.1.56
pcelsVendorValueAuxClass                 O     1.3.6.1.1.9.1.57
pcelsPolicySetName                       A     1.3.6.1.1.9.2.1
pcelsDecisionStrategy                    A     1.3.6.1.1.9.2.2
pcelsPolicySetList                       A     1.3.6.1.1.9.2.3
pcelsPriority                            A     1.3.6.1.1.9.2.4
pcelsPolicySetDN                         A     1.3.6.1.1.9.2.5
pcelsConditionListType                   A     1.3.6.1.1.9.2.6
pcelsConditionList                       A     1.3.6.1.1.9.2.7
pcelsActionList                          A     1.3.6.1.1.9.2.8
pcelsSequencedActions                    A     1.3.6.1.1.9.2.9
pcelsExecutionStrategy                   A     1.3.6.1.1.9.2.10
pcelsVariableDN                          A     1.3.6.1.1.9.2.11
pcelsValueDN                             A     1.3.6.1.1.9.2.12
pcelsIsMirrored                          A     1.3.6.1.1.9.2.13
pcelsVariableName                        A     1.3.6.1.1.9.2.14
pcelsExpectedValueList                   A     1.3.6.1.1.9.2.15
pcelsVariableModelClass                  A     1.3.6.1.1.9.2.16
pcelsVariableModelProperty               A     1.3.6.1.1.9.2.17
pcelsExpectedValueTypes                  A     1.3.6.1.1.9.2.18
pcelsValueName                           A     1.3.6.1.1.9.2.19
pcelsIPv4AddrList                        A     1.3.6.1.1.9.2.20
pcelsIPv6AddrList                        A     1.3.6.1.1.9.2.21
pcelsMACAddrList                         A     1.3.6.1.1.9.2.22
pcelsStringList                          A     1.3.6.1.1.9.2.23
pcelsBitStringList                       A     1.3.6.1.1.9.2.24
pcelsIntegerList                         A     1.3.6.1.1.9.2.25
pcelsBoolean                             A     1.3.6.1.1.9.2.26
pcelsReusableContainerName               A     1.3.6.1.1.9.2.27
pcelsReusableContainerList               A     1.3.6.1.1.9.2.28
pcelsRole                                A     1.3.6.1.1.9.2.29
pcelsRoleCollectionName                  A     1.3.6.1.1.9.2.30
pcelsElementList                         A     1.3.6.1.1.9.2.31
pcelsFilterName                          A     1.3.6.1.1.9.2.32
pcelsFilterIsNegated                     A     1.3.6.1.1.9.2.33
pcelsIPHdrVersion                        A     1.3.6.1.1.9.2.34
pcelsIPHdrSourceAddress                  A     1.3.6.1.1.9.2.35
pcelsIPHdrSourceAddressEndOfRange        A     1.3.6.1.1.9.2.36
pcelsIPHdrSourceMask                     A     1.3.6.1.1.9.2.37
pcelsIPHdrDestAddress                    A     1.3.6.1.1.9.2.38
pcelsIPHdrDestAddressEndOfRange          A     1.3.6.1.1.9.2.39
pcelsIPHdrDestMask                       A     1.3.6.1.1.9.2.40
pcelsIPHdrProtocolID                     A     1.3.6.1.1.9.2.41
pcelsIPHdrSourcePortStart                A     1.3.6.1.1.9.2.42
pcelsIPHdrSourcePortEnd                  A     1.3.6.1.1.9.2.43
pcelsIPHdrDestPortStart                  A     1.3.6.1.1.9.2.44
pcelsIPHdrDestPortEnd                    A     1.3.6.1.1.9.2.45
pcelsIPHdrDSCPList                       A     1.3.6.1.1.9.2.46
pcelsIPHdrFlowLabel                      A     1.3.6.1.1.9.2.47
pcels8021HdrSourceMACAddress             A     1.3.6.1.1.9.2.48
pcels8021HdrSourceMACMask                A     1.3.6.1.1.9.2.49
pcels8021HdrDestMACAddress               A     1.3.6.1.1.9.2.50
pcels8021HdrDestMACMask                  A     1.3.6.1.1.9.2.51
pcels8021HdrProtocolID                   A     1.3.6.1.1.9.2.52
pcels8021HdrPriority                     A     1.3.6.1.1.9.2.53
pcels8021HdrVLANID                       A     1.3.6.1.1.9.2.54
pcelsFilterListName                      A     1.3.6.1.1.9.2.55
pcelsFilterDirection                     A     1.3.6.1.1.9.2.56
pcelsFilterEntryList                     A     1.3.6.1.1.9.2.57
pcelsVendorVariableData                  A     1.3.6.1.1.9.2.58
pcelsVendorVariableEncoding              A     1.3.6.1.1.9.2.59
pcelsVendorValueData                     A     1.3.6.1.1.9.2.60
pcelsVendorValueEncoding                 A     1.3.6.1.1.9.2.61
pcelsRuleValidityPeriodList              A     1.3.6.1.1.9.2.62

where Type A is Attribute, Type O is ObjectClass 🌸

These assignments are recorded in the following registry: http://www.iana.org/assignments/ldap-parameters 🎀

8. Acknowledgements 🫶

we'd like to thank Kurt Zeilenga, Bert Wijnen, Ryan Moats, John Strassner, David McTavish, Larry Bartz and all the other members of the Policy Framework WG for reviewing this document and making many helpful suggestions and corrections 💜

we'd also like to thank Joel Halpern (co-chair of the Policy Framework WG) for his support, for bringing this document to the attention of the Policy Framework WG and for moderating the resulting interactions 🙌

9. Normative References 📚

  • [KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
  • [CIM] Distributed Management Task Force, Inc., "Common Information Model (CIM) Specification", Version 2.2, June 14, 1999, http://www.dmtf.org/standards/documents/CIM/DSP0004.pdf
  • [CIM_LDAP] Distributed Management Task Force, Inc., "DMTF LDAP Schema for the CIM v2.5 Core Information Model", April 15, 2002, http://www.dmtf.org/standards/documents/DEN/DSP0123.pdf
  • [PCIM] Moore, B., Ellesson, E., Strassner, J., and A. Westerinen, "Policy Core Information Model -- Version 1 Specification", RFC 3060, February 2001.
  • [PCIM_EXT] Moore, B., "Policy Core Information Model (PCIM) Extensions", RFC 3460, January 2003.
  • [PCLS] Strassner, J., Moore, B., Moats, R., and E. Ellesson, "Policy Core Lightweight Directory Access Protocol (LDAP) Schema", RFC 3703, February 2004.
  • [LDAP] Hodges, J. and R. Morgan, "Lightweight Directory Access Protocol (v3): Technical Specification", RFC 3377, September 2002.
  • [LDAP_SYNTAX] Wahl, M., Coulbeck, A., Howes, T., and S. Kille, "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997.
  • [LDAP_SCHEMA] Wahl, M., "A Summary of the X.500(96) User Schema for use with LDAPv3", RFC 2256, December 1997.
  • [LDAP_MATCH] Zeilenga, K., "Lightweight Directory Access Protocol (LDAP): Additional Matching Rules", RFC 3698, February 2004.
  • [X.501] The Directory: Models. ITU-T Recommendation X.501, 2001.
  • [X.520] The Directory: Selected Attribute Types. ITU-T Recommendation X.520, 2001.

10. Informative References 🦋

  • [LDAP-IANA] Zeilenga, K., "Internet Assigned Numbers Authority (IANA) Considerations for the Lightweight Directory Access Protocol (LDAP)", BCP 64, RFC 3383, September 2002.

Authors' Addresses 💖

Okay, meet the squad! These are the five people who wrote this one:

Mircea Pana
MetaSolv Software Inc.
360 Legget Drive
Ottawa, Ontario, Canada
K2K 3N1

EMail: mpana@metasolv.com

Angelica Reyes
Department of Computer Architecture
Technical University of Catalonia
Campus Castelldefels
Spain

EMail: mreyes@ac.upc.edu

Antoni Barba
Technical University of Catalonia
Jordi-Girona 1-3
08034 Barcelona
Spain

EMail: telabm@mat.upc.es

David Moron
Technical University of Catalonia
Jordi-Girona 1-3
08034 Barcelona
Spain

EMail: dmor4477@hotmail.com

Marcus Brunner
NEC Europe Ltd.
Kurfuersten-Anlage 36
D-69115 Heidelberg
Germany

EMail: brunner@netlab.nec.de

Five authors, three countries, and a whole lot of brains 🧠🌸

Okay, legal stuff, but make it cute 💅 The Internet Society owns the copyright here, and it's dated 2005 ✨

This document is covered by the rights, licenses, and restrictions in BCP 78. The authors keep all their rights, except for whatever that BCP says otherwise.

The doc and everything in it is handed over "AS IS" 🫶 No promises. The contributor, the organization they represent or are sponsored by (if any), the Internet Society, and the IETF all say no to every warranty, whether it's stated or implied. That covers not infringing anyone's rights, and it also covers being merchantable or fit for a particular purpose 😭

Intellectual Property 🦋

Let's talk about who owns what (or who might own what) 👑 The IETF doesn't say whether any patents or other rights apply to the tech in this doc. It also doesn't say whether you could get a license to use them, or whether one even exists. And it hasn't gone hunting for any of that either 🙈 If you want the details on how rights work for RFCs, check out BCP 78 and BCP 79.

Want copies of IPR disclosures sent to the IETF Secretariat? Or the license assurances? Or results from trying to get a general license for implementers or users? Those are all in the IETF online IPR repository at http://www.ietf.org/ipr 💜

Also, if you know about any copyrights, patents, patent applications, or other proprietary rights that might cover tech you'd need to implement this standard, the IETF wants to hear about it! Send it to ietf-ipr@ietf.org 🧚

Acknowledgement 🌈

Last but definitely not least, a shoutout to whoever is paying the bills! 💅 Funding for the RFC Editor function is currently provided by the Internet Society. Thank you, Internet Society, you're iconic ⭐

📦 where this page comes from