Use of an X.500/LDAP directory to support MIXER address mapping
obsoletes
- rfc-1838 — Use of the X.500 Directory to support mapping between X.400 and RFC 822 Addresses
Extracted elements (20)
MCGAMs are stored in two dedicated subtrees of the DIT rather than in routing subtrees. This allows mapping information to be widely replicated efficiently, facilitates migration from a table-based approach, and handles missing OR address components naturally. The alternative of co-locating with routing subtrees was explicitly rejected as offering fewer benefits.
Functionally, all address translation takes place exactly according to MIXER (RFC 2156); the directory provides only the storage and lookup mechanism. The longest-match algorithm mirrors the table-based approach specified in MIXER.
The manager of an MCGAM shall make the appropriate directory entry for authoritative mappings placed in the open community tree.
There shall never be both an associatedDomain and an associatedInternetGateway attribute in the same directory entry, because an OR Address maps to either a domain or a gateway but never both.
There shall never be both an associatedX400Gateway and an associatedORAddress attribute in the same directory entry, because a domain maps to either a gateway or an OR Address but never both.
When cryptographic authentication is available for directory responses, clients shall employ those mechanisms to verify the authenticity and integrity of those responses.
Where MCGAMs are accessed from multiple sources, it is recommended that all sources be accessed in order to determine the MCGAM giving the best (longest) match.
RFC-822-to-X.400 longest-match lookup: (1) derive a directory name from the domain part of the RFC 822 address; (2) look it up in the RFC-822-to-X.400 subtree for associatedORAddress or associatedX400Gateway; if multiple associatedX400Gateway values are present the MTA may choose which to use. Mapping is always achievable in two lookups.
The mixerGateway auxiliary object class (subclass of mhs-message-transfer-agent) must contain mcgamTables, a single-valued SEQUENCE OF DistinguishedName giving an ordered list of MCGAM collection roots the gateway uses for lookup.
The omittedORAddressComponent object class (subclass of top) must contain the oRAddressComponentType attribute (subtype of objectIdentifier), identifying via OID an X.400 OR address component that is absent in the mapping. This mechanism is restricted to the X.400-to-RFC-822 subtree and the at-associated-or-address attribute.
The rfc822ToX400Mapping object class (subclass of domain-component) optionally holds associatedORAddress (single DN) or associatedX400Gateway (multi-value mhs-or-addresses), mapping RFC 822 domain hierarchy entries to X.400 OR Addresses or fallback gateways.
The x400ToRFC822Mapping object class (subclass of top) optionally holds associatedDomain (single caseIgnoreIA5String) or associatedInternetGateway (multi-value caseIgnoreIA5String), mapping X.400 OR Address hierarchy entries to RFC 822 domains or Internet gateways.
X.400-to-RFC-822 longest-match lookup: (1) derive a directory name from the OR Address down to the lowest OU; (2) look it up in the X.400-to-RFC-822 subtree — a failed lookup indicates the longest match, which is then looked up; (3) check for associatedDomain or associatedInternetGateway. The mapping is always achievable in two lookups.
Object identifiers are assigned under mhs-ds (1.3.6.1.4.1.453.7), mapping subtree at {mhs-ds 4}, object classes at {mapping 1} (oc-rfc822-to-x400-mapping=1, oc-x400-to-rfc822-mapping=2, oc-omitted-or-address-component=3, oc-mixer-gateway=4), and attributes at {mapping 2} (at-associated-or-address=6, at-associated-x400-gateway=3, at-associated-domain=4, at-or-address-component-type=7, at-associated-internet-gateway=8, at-mcgam-tables=9).
A successful attack on the MCGAM directory service could forge an originator address or redirect mail to an unauthorized recipient. Clients must use cryptographic authentication of directory responses when available to verify authenticity and integrity.
The associatedDomain attribute is a single-valued subtype of name with caseIgnoreIA5String syntax, holding the RFC 822 domain that an X.400 OR Address maps to. OID: at-associated-domain ({at 4}).
The associatedInternetGateway attribute is a multi-valued subtype of name with caseIgnoreIA5String syntax, identifying Internet gateways as a fallback mapping. OID: at-associated-internet-gateway ({at 8}).
The associatedORAddress attribute is a single-valued subtype of distinguishedName, encoding the target X.400 OR Address as a DN (e.g., PRMD=Isode, ADMD=Mailnet, C=FI). OID: at-associated-or-address ({at 6}).
The associatedX400Gateway attribute is a multi-valued subtype of mhs-or-addresses, identifying one or more X.400 gateway OR Addresses as a fallback when no equivalence mapping exists. OID: at-associated-x400-gateway ({at 3}).
The mcgamTables attribute is single-valued with syntax SEQUENCE OF DistinguishedName, enumerating an ordered list of MCGAM collection subtree roots. OID: at-mcgam-tables ({at 9}).