Policy Core Extension Lightweight Directory Access Protocol Schema (PCELS)
updates
- rfc-3703 — Policy Core Lightweight Directory Access Protocol (LDAP) Schema
Extracted elements (30)
pcelsVendorVariableAuxClass and pcelsVendorValueAuxClass are introduced as LDAP-only constructs not derived from PCIM_EXT, providing a standard extension mechanism for vendor-specific policy variables and values. This avoids the need to modify the information model for proprietary extensions.
PolicyRoleCollectionInSystem is mapped to DIT containment because it is a weak association, and weak associations map well to DIT containment per the CIM-LDAP mapping guidelines. In the absence of additional constraints, DIT containment is the optimal choice.
The ReusablePolicy association is mapped to DIT containment rather than DN references for scalability reasons: it is expected that a large number of policy instances will be associated to a ReusablePolicyContainer, and DIT containment is a type of association that scales well in LDAP.
LDAP matching rules (e.g., caseIgnoreMatch for pcelsIPv4AddrList) may not cover all application-level semantic equivalences. Implementers MUST NOT rely solely on LDAP syntaxes and matching rules for ensuring consistency with this specification; application-level equivalence checking is required.
PCELS is designed for harmless coexistence with RFC 3703 (PCLS) implementations in the same data repository. However, three compatibility impacts exist: pcimRoles is now also used by pcelsPolicySet; condition/action association classes originally for pcimRule are now also used by pcelsRule subclasses; and pcimRepository containers may include entries of types unknown to PCLS implementations.
If a PCELS application requires functionality provided by PCLS base classes (pcimPolicy, pcimRuleConditionAssociation, pcimRuleActionAssociation, pcimConditionAuxClass, pcimActionAuxClass, pcimRepository), those PCLS classes MUST also be supported by PCELS implementations.
If any attribute value constraint is violated (e.g., invalid integer value for pcelsDecisionStrategy), the entry SHOULD be treated as invalid and the policy rules or groups referencing it SHOULD be treated as disabled.
If pcelsConditionListType is missing from a pcelsRule, applications MUST assume disjunctive normal form (value 1). If pcelsSequencedActions is missing, applications MUST assume DontCare (value 3). If pcelsExecutionStrategy is missing, applications MUST assume Do all (value 2).
If the pcelsDecisionStrategy attribute is missing from a pcelsPolicySet instance, applications MUST assume a FirstMatching decision strategy for the policy set.
PCELS implementations SHOULD support pcelsRule and pcelsGroup (and their subclasses) and MAY also support the superseded pcimRule and pcimGroup from RFC 3703. Applications supporting pcelsRule/pcelsGroup MUST use pcelsPolicySetAssociation for aggregation.
When reading a pcelsPolicySetAssociation instance that has a pcelsPolicySet attached as an auxiliary class, the attribute pcelsPolicySetDN MUST be ignored. Applications SHOULD remove the pcelsPolicySetDN value upon such attachment.
When reading a pcelsRule instance that has a pcimConditionAuxClass attached, the attribute pcelsConditionList MUST be ignored from the policy rule perspective. Similarly, when a pcimActionAuxClass is attached, pcelsActionList MUST be ignored.
Within the set of pcelsPolicySetAssociation entries directly subordinated to a pcelsPolicySet or dlm1System, the pcelsPriority values MUST be unique.
pcelsActionAssociation is a structural class derived from pcimRuleActionAssociation used to aggregate PolicyAction instances. When subordinated to a pcelsRule it realizes PolicyActionInPolicyRule; when subordinated to a pcelsCompoundActionAuxClass it realizes PolicyActionInPolicyAction.
pcelsCompoundActionAuxClass is an auxiliary class derived from pcimActionAuxClass enabling grouping of multiple policy actions with ExecutionStrategy and SequencedActions semantics. Actions are aggregated via subordinate pcelsActionAssociation entries.
pcelsCompoundConditionAuxClass and pcelsCompoundFilterConditionAuxClass are auxiliary classes derived from pcimConditionAuxClass enabling grouping of multiple conditions with a ConditionListType (disjunctive or conjunctive). pcelsCompoundFilterConditionAuxClass further specializes for filter-based conditions.
pcelsConditionAssociation is a structural class derived from pcimRuleConditionAssociation used to aggregate PolicyCondition instances. When subordinated to a pcelsRule it realizes PolicyConditionInPolicyRule; when subordinated to a pcelsCompoundConditionAuxClass it realizes PolicyConditionInPolicyCondition.
pcelsGroup is an abstract LDAP object class derived from pcelsPolicySet representing a policy group, with structural subclass pcelsGroupInstance and auxiliary subclass pcelsGroupAuxClass. Policy groups may now aggregate both rules and groups via pcelsPolicySetAssociation.
pcelsIPHeadersFilter is a structural class derived from pcelsFilterEntryBase implementing IP header-based packet filtering. pcels8021Filter is a structural class implementing IEEE 802.1 (Ethernet/VLAN) header-based filtering. Both are device-level filter classes new to PCELS.
pcelsPolicySet is an abstract LDAP object class derived from pcimPolicy that represents a set of policies with a common decision strategy and role set. It includes attributes pcelsPolicySetName, pcelsDecisionStrategy, pcimRoles, and pcelsPolicySetList (DNs of subordinate pcelsPolicySetAssociation entries).
pcelsPolicySetAssociation is a structural LDAP object class derived from pcimPolicy used to associate PolicySet instances to other entries. It MUST include a pcelsPriority attribute and MAY include pcelsPolicySetName and pcelsPolicySetDN. It is always subordinated to the aggregating entry.
pcelsReusableContainer is an abstract class derived from pcimRepository providing a named container for reusable policy components (groups, rules, conditions, actions, variables, values). It has structural subclass pcelsReusableContainerInstance and auxiliary subclass pcelsReusableContainerAuxClass.
pcelsRoleCollection is a structural LDAP class derived from pcimPolicy enabling the association of policy roles to resources represented as LDAP entries. Elements are associated via DIT containment or the pcelsElementList attribute.
pcelsRule is an abstract LDAP object class derived from pcelsPolicySet representing a policy rule, with structural subclass pcelsRuleInstance and auxiliary subclass pcelsRuleAuxClass. It carries attributes for validity periods, condition/action lists, sequenced actions, and execution strategy.
pcelsSimpleConditionAuxClass is an auxiliary class derived from pcimConditionAuxClass implementing a value-matching condition for a variable. It references its variable and value via pcelsVariableDN and pcelsValueDN, or by direct auxiliary attachment to the same entry.
pcelsValueAuxClass is an abstract auxiliary class with typed subclasses for policy values: pcelsIPv4AddrValueAuxClass, pcelsIPv6AddrValueAuxClass, pcelsMACAddrValueAuxClass, pcelsStringValueAuxClass, pcelsBitStringValueAuxClass, pcelsIntegerValueAuxClass, and pcelsBooleanValueAuxClass.
pcelsVariable is an abstract class with subclasses for explicit and implicit policy variables. Implicit variable subclasses cover network header fields: SourceIPv4, SourceIPv6, DestinationIPv4, DestinationIPv6, SourcePort, DestinationPort, IPProtocol, IPVersion, IPToS, DSCP, FlowId, SourceMAC, DestinationMAC, VLAN, CoS, Ethertype, SourceSAP, DestinationSAP, SNAPOUI, SNAPType, and FlowDirection.
pcelsVendorVariableAuxClass and pcelsVendorValueAuxClass are auxiliary classes providing a standard extension mechanism for vendor-specific policy variables and values not specifically modeled in PCIM_EXT. These are LDAP-only constructs introduced by this document, not mapped from PCIM_EXT.
Section 7 registers a new OID arc (1.3.6.1.1.9) for PCELS object classes and attribute types, and registers OID descriptors for all new LDAP object classes (prefixed 'pcels') and attribute types defined in this document with IANA.
Section 6 addresses security considerations for PCELS. Because policy information stored in LDAP controls network behavior, unauthorized access or modification could compromise network security. Implementations should apply LDAP access control mechanisms and consider the security considerations of RFC 3703 (PCLS) and RFC 2829/2830 (LDAP authentication).