The drawings contained in this Recommendation have been done in AUTOCAD

Recommendation X.521

THE DIRECTORY - SELECTED OBJECT CLASSES )

(Melbourne, 1988)

CONTENTS

0	Introduction

1	Scope and field of application

2	References

3	Definitions and abbreviations

3.1	OSI Reference Model Definitions

3.2	Directory Model Definitions

4	Notation

SECTION 1 - Selected Object Classes

5	Definitions of Useful Attribute Sets

5.1	Telecommunication Attribute Set

5.2	Postal Attribute Set

5.3	Locale Attribute Set

5.4	Organizational Attribute Set

6	Definition of Selected Object Classes

6.1	Top

6.2	Alias

6.3	Country

6.4	Locality

6.5	Organization

6.6	Organizational Unit

6.7	Person

6.8	Organizational Person

6.9	Organizational Rôle

6.10	Group of Names

6.11	Residential Person

6.12	Application Process

6.13	Application Entity

6.14	DSA

6.15	Device

6.16	Strong Authentication User

6.17	Certification Authority

Annex A - Selected Object Classes in ASN.1

Annex B - Suggested Name Forms and DIT Structures

0	Introduction

0.1	This document, together with the others of the series, has been produced to facilitate the interconnection of information processing systems to provide directory services. The set of all such systems, together with the directory information which they hold, can be viewed as an integrated whole, called the Directory. The information held by the Directory, collectively known as the Directory Information Base (DIB), is typically used to facilitate communication between, with or about objects such as application entities, people, terminals, and distribution lists.

0.2	The Directory plays a significant role in Open Systems Interconnection, whose aim is to allow, with a minimum of technical agreement outside of the interconnection standards themselves, the interconnection of information processing systems:

-	from different manufacturers;

-	under different managements;

-	of different levels of complexity; and

-	of different ages.

0.3	This Recommendation defines (in section one) a number of attribute sets and object classes which may be found useful across a range of applications of the Directory.

0.4	Annex A, which is a part of the standard, provides an ASN.1 module containing all of the type and value definitions which appear in this document.

0.5	Annex B, which is not part of the Recommendation provides some common naming and structure rules which may or may not be used by Administrative authorities.

1	Scope and field of application

1.1	This Recommendation defines a number of selected attribute sets and object classes which may be found useful across a range of applications of the Directory. The definition of an attribute set involves identifying the attributes that it contains, and facilitates the definition of object classes. The definition of an object class involves optionally allocating an Object Identifier to it, and listing a number of attribute types which are relevant to objects of that class. These definitions are used by the administrative authority which is responsible for the management of the Directory information.

1.2	Any Administrative Authority can define its own object classes and subclasses for any purpose.

Note 1 - These definitions may or may not use the notation specified in Recommendation X.501.

Note 2 - It is recommended that an object class defined in this document, or a subclass derived from one, be used in preference to the generation of a new one, whenever the semantics is appropriate for the application.

1.3	Administrative authorities may support some or all the selected object classes, and may also add object classes.

All Administrative authorities shall support the object classes which the directory uses for its own purpose (the top, alias and DSA object classes).

2	References

Recommendation X.200	- Open Systems Interconnection - Basic Reference Model (see also ISO 7498)

Recommendation X.500	- The Directory - Overview of Concepts, Models and Services (see also ISO 9594-1)

Recommendation X.501	- The Directory - Models (see also ISO 9594-2)

3	Definitions and abbreviations

3.1	OSI Reference Model Definitions

This Recommendation makes use of the following definitions from Recommendation X.200:

a)	application-entity;

b)	application-process.

3.2	Directory Model Definitions

This Recommendation makes use of the following definitions from Recommendation X.501.

a)	attribute;

b)	attribute type;

c)	Directory Information Tree (DIT);

d)	Directory System Agent (DSA);

e)	attribute set;

f)	entry;

g)	name;

h)	object class;

i)	subclass.

4	Notation

Object classes are defined in this document by the use of special notation, defined as an ASN.1 macro, OBJECT-CLASS, in Recommendation X.501. One "generic" object identifier (objectClass) is used in specifying the object identifiers being allocated to object classes. Its definition can be found in Annex B of the same Recommendation.

Attribute sets are defined in this document by the use of special notation, defined as an ASN.1 macro ATTRIBUTE-SET, in Recommendation X.501. One "generic" object identifier (attributeSet) is used in specifying the object identifiers being allocated to attribute set definitions. Its definition can be found in Annex B of the same Recommendation.

SECTION 1 - Selected Object Classes

5	Definition of Useful Attribute Sets

5.1	Telecommunication Attribute Set

This set of attributes is used to define those which are commonly used for business communications.

telecommunicationAttributeSet ATTRIBUTE-SET

CONTAINS {

facsimileTelephoneNumber,

iSDNAddress,

telephoneNumber,

teletexTerminalIdentifier,

telexNumber, X121Address,

preferredDeliveryMethod,

destinationIndicator,

registeredAddress}

::= {attributeSet 0}

5.2	Postal Attribute Set

This set of attributes is used to define those which are directly associated with postal delivery.

postalAttributeSet ATTRIBUTE-SET

CONTAINS {

physicalDeliveryOfficeName,

postalAddress,

postalCode,

postOfficeBox,

streetAddress}

::= {attributeSet 1}

5.3	Locale Attribute Set

This set of attributes is used to define those which are commonly used for search purposes to indicate the locale of an object.

localeAttributeSet ATTRIBUTE-SET

CONTAINS {

localityName,

stateOrProvinceName,

streetAddress}

::= {attributeSet 2}

5.4	Organizational Attribute Set

This set of attributes is used to define the attributes that an organization or organizational unit may typically possess.

organizationalAttributeSet ATTRIBUTE-SET

CONTAINS {

description,

localeAttributeSet,

postalAttributeSet,

telecommunicationAttributeSet,

businessCategory,

seeAlso,

searchGuide,

userPassword}

::= {attributeSet 3}

6	Definition of Selected Object Classes

6.1	Top

The top object class, of which every other object class is a subclass, is defined, except for the allocation of an object identifier, in Recommendation X.501.

top	Top	::= {objectClass 0}

6.2	Alias

The alias object class, from which classes for alias entries may be derived, is defined, except for the allocation of an object identifier, in Recommendation X.501.

alias Alias ::= {objectClass 1}

6.3	Country

A Country object class is used to define country entries in the DIT.

country OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

countryName}

MAY CONTAIN {

description,

searchGuide}

::= {objectClass 2}

6.4	Locality

The Locality object class is used to define locality in the DIT.

Locaty OBJECT-CLASS

SUBCLASS OF top

MAY CONTAIN {

description,

localityName,

stateOrProvinceName,

searchGuide,

seeAlso,

streetAddress}

::= {objectClass 3}

At least one of Locality Name or State or Province Name must be present.

6.5	Organization

The Organization object class is used to define organization entries in the DIT.

organization OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

organizationName}

MAY CONTAIN {

organizationalAttributeSet}

::= {objectClass 4}

6.6	Organizational Unit

The Organizational Unit object class is used to define entries representing subdivisions or organizations.

organizationalUnit OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

organizationalUnitName}

MAY CONTAIN {

organizationalAttributeSet}

::= {objectClass 5}

6.7	Person

The Person object class is used to define entries representing people generically.

person OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName,

surname}

MAY CONTAIN {

description,

seeAlso,

telephoneNumber,

userPassword}

::= {objectClass 6}

6.8	Organizational Person

The Organizational Person object class is used to define entries representing people employed by, or in some other important way associated with, an organization.

organizationalPerson OBJECT-CLASS

SUBCLASS OF person

MAY CONTAIN {

localeAttributeSet,

organizationalUnitName,

postalAttributeSet,

telecommunicationAttributeSet,

title}

::= {objectClass 7}

6.9	Organizational Rôle

The Organizational Rôle object class is used to define entries representing an organizational role, i.e. a position or rôle within

an organization. An organizational rôle is normally considered to be filled by a particular organizational person. Over its lifetime, however, an organizational rôle may be filled by a number of different organizational people in succession. In general, an organizational rôle may be filled by a person or a non-human entity.

organizationalRole OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName}

MAY CONTAIN {

description,

localeAttributeSet,

organizationalUnitName,

postalAttributeSet,

preferredDeliveryMethod,

roleOccupant,

seeAlso,

telecommunicationAttributeSet}

::= {objectClass 8}

6.10	Group of Names

The Group of Names object class is used to define entries representing an unordered set of names which represent individual objects or other groups

of names. The membership of a group is static; that is, it is explicitly modified by administrative action, rather than dynamically determined each time the group is referred to.

The membership of a group can be reduced to a set of individual object's names by replacing each group with its membership. This process could be carried out recursively until all constituent group names have been eliminated, and only the names of individual objects remain.

groupOfNames OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName,

member}

MAY CONTAIN {

description,

organizationName,

organizationalUnitName,

owner,

seeAlso,

businessCategory}

::= {objectClass 9}

6.11	Residential Person

The Residential Person object class is used to define entries representing a person in the residential environment.

residentialPerson OBJECT-CLASS

SUBCLASS OF person

MUST CONTAIN {

localityName}

MAY CONTAIN {

localeAttributeSet,

postalAttributeSet,

preferredDeliveryMethod,

telecommunicationAttributeSet,

businessCategory}

::= {objectClass 10}

6.12	Application Process

The Application Process object class is used to define entries representing application processes. An application process is an element within a real open system which performs the information processing for a particular application (see Recommendation X.200).

applicationProcess OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName}

MAY CONTAIN {

description,

localityName,

organizationalUnitName,

seeAlso}

::= {objectClass 11}

6.13	Application Entity

The Application Entity object class is used to define entries representing application entities. An application entity consists of those aspects of an application-process pertinent to OSI.

applicationEntity OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName,

presentationAddress}

MAY CONTAIN {

description,

localityName,

organizationName,

organizationalUnitName,

seeAlso,

supportedApplicationContext}

::= {objectClass 12}

Note - If Application Entity is represented as a Directory object that is distinct from an Application Process, the commonName attribute is used to carry the value of Application Entity Qualifier.

6.14	DSA

The DSA object class is used to define entries representing DSAs. A DSA is as defined in Recommendation X.501.

dSA OBJECT-CLASS

SUBCLASS OF applicationEntity

MAY CONTAIN {

knowledgeInformation}

::= {objectClass 13}

6.15	Device

The Device object class is used to define entries representing devices. A device is a physical unit which can communicate, such as a modem, disk drive, etc.

device OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName}

MAY CONTAIN {

description,

localityName,

organizationName,

organizationalUnitName,

owner,

seeAlso,

serialNumber}

::= {objectClass 14}

Note - At least one of localityName, serialNumber, owner, should be included. The choice is dependent on device type.

6.16	Strong Authentication User

The Strong Authentication User object class is used in defining entries for objects which participate in strong authentication, as defined in Recommendation X.509.

strongAuthenticationUser OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {userCertificate}

::= {objectClass 15}

The Certification Authority object class is used in defining entries for objects which act as certification authorities, as defined in Recommendation X.509.

certificationAuthority OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

cACertificate,

certificateRevocationList,

authorityRevocationList }

MAY CONTAIN {crossCertificatePair}

::= {objectClass 16}

ANNEX A

(to Recommendation X.521)

Selected Object Classes in ASN.1

This Annex includes all of the ASN.1 type and value definitions contained in this Recommendation in the form of the ASN.1 module, SelectedObjectClasses.

SelectedObjectClasses	{joint-ISO-CCITT ds(5) modules(1)

selectedObjectClasses(6)}

DEFINITIONS ::=

BEGIN

-- exports everything

IMPORTS

objectClass, attributeSet, informationFramework, selectedAttributeTypes

FROM UsefulDefinitions {joint-iso-ccitt ds(5) modules(1) usefulDefinitions(0)}

OBJECT-CLASS,ATTRIBUTE-SET, Top, Alias

FROM InformationFramework informationFramework

authorityRevocationList, businessCategory, CACertificate, certificateRevocationList,

commonName, countryName, description, destinationIndicator, facsimileTelephoneNumber,

internationalISDNNumber, knowledgeInformation, localityName, member, organizationName,

organizationalUnitName, owner, physicalDeliveryOfficeName, postOfficeBox, postalAddress,

postalCode, preferredDeliveryMethod, presentationAddress, registeredAddress,

roleOccupant, searchGuide, seeAlso, serialNumber, stateOrProvinceName, streetAddress,

supportedApplicationContext, surname, telephoneNumber, teletexTerminalIdentifier,

telexNumber, title, userCertificate, userPassword, x121Address

FROM SelectedAttributeTypes selectedAttributeTypes;

telecommunicationAttributeSet ATTRIBUTE-SET

CONTAINS {

facsimileTelephoneNumber,

iSDNAddress,

telephoneNumber,

teletexTerminalIdentifier,

telexNumber,

x121Address, preferredDeliveryMethod, destinationIndicator,

registeredAddress}

::= {attributeSet 0}

postalAttributeSet ATTRIBUTE-SET

CONTAINS {

physicalDeliveryOfficeName,

postalAddress,

postalCode,

postOfficeBox,

streetAddress}

::= {attributeSet 1}

localeAttributeSet ATTRIBUTE-SET

CONTAINS {

localityName,

stateOrProvinceName,

streetAddress}

::= {attributeSet 2}

organizationalAttributeSet ATTRIBUTE-SET

CONTAINS {

description,

localeAttributeSet,

postalAttributeSet,

telecommunicationAttributeSet,

businessCategory,

seeAlso,

searchGuide,

userPassword}

::= {attributeSet 3}

top	Top ::= {objectclass 0}

alias	Alias ::= {objectClass 1}

country OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

countryName}

MAY CONTAIN {

description,

searchGuide}

::= {objectClass 2}

locality OBJECT-CLASS

SUBCLASS OF top

MAY CONTAIN {

description,

localityName,

stateOrProvinceName,

searchGuide,

seeAlso,

streetAddress}

::= {objectClass 3}

organization OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

organizationName}

MAY CONTAIN {

organizationalAttributeSet}

::= {objectClass 4}

organizationalUnit OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

organizationalUnitName}

MAY CONTAIN {

organizationalAttributeSet}

::= {objectClass 5}

person OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName,

surname}

MAY CONTAN {

description,

seeAlso,

telephoneNumber,

userPassword}

::= {objectClass 6}

organizationalPerson OBJECT-CLASS

SUBCLASS OF person

MAY CONTAIN {

localeAttributeSet,

organizationalUnitName,

postalAttributeSet,

telecommunicationAttributeSet,

title}

::= {objectClass 7}

organizationalRole OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName}

MAY CONTAIN {

description,

localeAttributeSet,

organizationalUnitName,

postalAttributeSet,

preferredDeliveryMethod,

roleOccupant,

seeAlso,

telecommunicationAttributeSet}

::= {objectClass 8}

groupOfNames OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName,

member}

MAY CONTAIN {

description,

organizationName,

organizationalUnitName,

owner,

seeAlso,

businessCategory}

::= {objectClass 9}

residentialPerson OBJECT-CLASS

SUBCLASS OF person

MUST CONTAIN {

localityName}

MAY CONTAIN {

localeAttributeSet,

postalAttributeSet,

preferredDeliveryMethod,

telecommunicationAttributeSet,

businessCategory}

::= {objectClass 10}

applicationProcess OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName}

MAY CONTAIN {

description,

localityName,

organizationalUnitName,

seeAlso}

::= {objectClass 11}

applicationEntity OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName,

presentationAddress}

MAY CONTAIN {

description,

localityName,

organizationName,

organizationalUnitName,

seeAlso,

supportedApplicationContext}

::= {objectClass 12}

dSA OBJECT-CLASS

SUBCLASS OF applicationEntity

MAY CONTAIN {

knowledgeInformation}

::= {objectClass 13}

device OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

commonName}

MAY CONTAIN {

description,

localityName,

organizationName,

organizationalUnitName,

owner,

seeAlso,

serialNumber}

::= {objectClass 14}

strongAuthenticationUser OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

userCertificate}

::= {objectClass 15}

certificationAuthority OBJECT-CLASS

SUBCLASS OF top

MUST CONTAIN {

cACertificate,

certificateRevocationList,

authorityRevocationList}

MAY CONTAIN {

crossCertificatePair}

::={objectClass 16}

END

ANNEX B

(to Recommendation X.521)

Suggested Name Forms and DIT Structures

This Annex is not part of this Recommendation.

This Annex suggests some common naming practices and DIT structures that may or may not be used by an Administrative authority. Naming practices and DIT structure definitions for an object class include specification of the attributes used for naming and which object classes its superior entry or its subordinate entry in the DIT can have. All entries of a given object class must include at least the attributes used for naming. Users of the Directory should be informed of the suggested name forms to be able to predict names of objects with which they communicate. The following paragraphs suggest naming and structure rules for some object classes.

The structure rules are depicted in Figure B-1/X.521.

FIGURE B-1/X.521 - 0704680-88

B.1	Country

Attribute countryName is used for naming.

The Root is the immediate superior to entries of object class country.

B.2	Organization

Attribute organizationName is used for naming.

The Root, country or locality can be immediate superior to entries of object class organization.

Note - When the organization is directly under the root, this denotes an international organization. The values of the organizationName attribute for international organizations must all be distinct.

B.3	Locality

Attribute localityName or stateOrprovinceName is used for naming.

The Root, country, locality, organization or organizationalUnit can be immediate superior to entries of object class locality.

B.4	Organizational Unit

Attribute organizationalUnitName is used for naming.

organization, organizationalUnit or locality can be immediate superior to entries of object class organizationalUnit.

B.5	Organizational Person

Attribute commonName and optionally organizationalUnitName is used for naming.

organization or organizationalUnit can be immediate superior to entries of object class organizationalPerson.

Note - There are two ways that an organizationalUnitName attribute may be acquired in names: by having an organizationalUnit object as superior or by having such an attribute directly.

B.6	Organizational Rôle

Attribute commonName is used for naming.

organization or organizationalUnit can be immediate superior to entries of object class organizationalRole.

Note - There are two ways that an organizationalUnitName attribute may be acquired in names: by having an organizationalUnit object as superior or by having such an attribute directly.

B.7	Group of Names

Attribute commonName is used for naming.

locality, organization or organizationalUnit can be immediate superior to entries of object class groupOfNames.

Note - There are two ways that an organizationalUnitName attribute may be acquired in names: by having an organizationalUnit object as superior or by having such an attribute directly.

B.8	Residential Person

Attribute commonName and optionally streetAddress is used for naming.

locality is the immediate superior to entries of object class residentialPerson.

B.9	Application Entity

Attribute commonName is used for naming. The commonName should contain an application-entity qualifier (see Recommendation X.200).

applicationProcess is the immediate superior to entries of object class applicationEntity.

B.10	Device

Attribute commonName is used for naming.

organization or organizationalUnit can be immediate superior to entries of object class device.

Note - There are two ways that an organizationalUnitName attribute may be acquired in names: by having an organizationalUnit object as superior or by having such an attribute directly.

B.11	Application Process

Attribute commonName is used for naming.

organization or organizationalUnit can be immediate superior to entries of object class applicationProcess.

Note 1 - How commonName should be chosen for an Application Entity is documented in Recommendation X.200.

Note 2 - There are two ways that an organizationalUnitName attribute may be acquired in names: by having an organizationalUnit object as superior or by having such an attribute directly.