One document matched: draft-ietf-crisp-firs-contact-00.txt
INTERNET-DRAFT Eric A. Hall
Document: draft-ietf-crisp-firs-contact-00.txt May 2003
Expires: December, 2003
Category: Standards-Track
Defining and Locating Contact Information
in the Federated Internet Registry Service
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC 2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet-
Drafts.
Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other
documents at any time. It is inappropriate to use Internet-Drafts
as reference material or to cite them other than as "work in
progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract
This document defines LDAP schema and searching rules for contact
persons, in support of the Internet Resource Query Service
described in [FIRS-ARCH] and [FIRS-CORE].
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
Table of Contents
1. Introduction..............................................2
2. Prerequisites and Terminology.............................2
3. Naming Syntax.............................................3
4. Object Classes and Attributes.............................4
5. Query Processing Rules....................................6
5.1. Query Pre-Processing...................................6
5.2. Query Bootstrapping....................................6
5.3. LDAP Matching..........................................7
5.4. Example Query..........................................7
6. Security Considerations...................................8
7. IANA Considerations.......................................8
8. Author's Addresses........................................8
9. Normative References......................................8
10. Acknowledgments..........................................10
11. Changes from Previous Versions...........................10
12. Full Copyright Statement.................................10
1. Introduction
This specification defines the naming syntax, object classes,
attributes, matching filters, and query processing rules for
storing and locating contact persons in the FIRS service. Refer to
[FIRS-ARCH] for information on the FIRS architecture and
[FIRS-CORE] for the schema definitions and rules which govern the
FIRS service as a whole.
The definitions in this specification are intended to be used with
FIRS. Their usage outside of FIRS is not prohibited, but any such
usage is beyond this specification's scope of authority.
2. Prerequisites and Terminology
The complete set of specifications in the FIRS collection
cumulative define a structured and distributed information service
using LDAPv3 for the data-formatting and transport functions. This
specification should be read in the context of the complete set of
specifications, which currently include the following:
draft-ietf-crisp-firs-arch-00, "The Federated Internet
Registry Service: Architecture and Implementation" [FIRS-
ARCH]
Hall I-D Expires: December 2003 [page 2]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
draft-ietf-crisp-firs-core-00, "The Federated Internet
Registry Service: Core Elements" [FIRS-CORE]
draft-ietf-crisp-firs-dns-00, "Defining and Locating DNS
Domains in the Federated Internet Registry Service"
[FIRS-DNS]
draft-ietf-crisp-firs-dnsrr-00, "Defining and Locating DNS
Resource Records in the Federated Internet Registry
Service" [FIRS-DNSRR]
draft-ietf-crisp-firs-contact-00, "Defining and Locating
Contact Persons in the Federated Internet Registry Service"
(this document) [FIRS-CONTCT]
draft-ietf-crisp-firs-asn-00, "Defining and Locating
Autonomous System Numbers in the Federated Internet
Registry Service" [FIRS-ASN]
draft-ietf-crisp-firs-ipv4-00, "Defining and Locating IPv4
Address Blocks in the Federated Internet Registry Service"
[FIRS-IPV4]
draft-ietf-crisp-firs-ipv6-00, "Defining and Locating IPv6
Address Blocks in the Federated Internet Registry Service"
[FIRS-IPV6]
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
in this document are to be interpreted as described in RFC 2119.
3. Naming Syntax
The naming syntax for contact entries in FIRS MUST follow the form
of "cn=<inetContactSyntax>,cn=inetResources,<partition>", where
<inetContactSyntax > is an email address representing a contact
resource, and where <partition> is a sequence of domainComponent
relative distinguished names which identifies the scope of
authority for the selected directory partition.
The inetContactSyntax is unstructured, in that it uses
standardized procedures to produce heavily-normalized email
addresses rather than using structured syntax rules. The principle
reason for this is due to conflicting syntax rules in different
canonical email addressing rules, with these rules preventing the
use of a common syntax.
Hall I-D Expires: December 2003 [page 3]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
The normalization procedure produces UTF-8 email addresses as
output, with these domain names being suitable for direct
comparisons, substring searches, and other lightweight
comparisons. Servers tend to be more heavily-loaded than clients,
and requiring the data to be normalized before it is used for
comparison operations ensures that a broader range of comparison
operations can be performed with minimal impact on those servers.
This normalization procedure is as follows:
a. Email addresses MUST contain three elements, which are a
localpart element, an "at" sign ("@") separator character,
and a domain element.
b. The localpart element is currently unspecified, pending
ongoing effort to internationalize this element. Subsequent
versions of this specification may define specific handling
rules for this element.
c. The domain element MUST be normalized according to the
inetDnsDomainSyntax procedure defined in [FIRS-DNS].
Once all of these steps have successfully completed, the email
address can be stored in the directory or used as an assertion
value. Any fatal error conditions encountered during these
conversions MUST result in a local failure; FIRS-aware
applications MUST NOT store or transmit non-normalized email
addresses for any purposes.
The inetContactSyntax syntax is as follows:
inetContactSyntax
( 1.3.6.1.4.1.7161.1.7.1 NAME 'inetContactSyntax' DESC 'A
fully-qualified email address.' )
Note that the use of the "at" separator character is illegal as
data in URLs, and these characters will be escaped before they are
stored in a URL as data.
4. Object Classes and Attributes
Contact entries in FIRS MUST use the inetOrgPerson object class as
defined in RFC 2798 [RFC2798], in addition to the mandatory object
classes defined in [FIRS-CORE]. Contact entries MUST be treated as
containers capable of holding subordinate entries. If an entry
Hall I-D Expires: December 2003 [page 4]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
exists as a referral source, the entry MUST also be defined with
the referral object class, in addition to the above requirements.
The inetOrgPerson object class is a structural object class. The
inetOrgPerson object class has three mandatory attributes (cn, sn,
and objectClass), and has several optional attributes. Contact
entries also inherit the attributes defined in the inetResources
object class when they are used with FIRS.
Refer to [RFC2798] for the inetOrgPerson schema definitions.
Note that the "mail" attribute is restricted to seven-bit
character codes, and is therefore not directly compatible with the
inetContactSyntax rules defined in section 3. That attribute MUST
use legacy-compatible encoding rules.
An example of the inetOrgPerson object class in use is shown in
Figure 1 below. The example includes attributes from the
inetOrgPerson, inetResources, and inetAssociatedResources object
classes.
cn=admins@example.com,cn=inetResources,dc=example,dc=com
[top object class]
[inetResources object class]
[inetOrgPerson object class]
[inetAssociatedResources object class]
|
+-attribute: description
| value: "Administrators for the example.com network."
|
+-attribute: givenName
| value: "Network"
|
+-attribute: sn
| value: "Administrators"
|
+-attribute: mail
| value: "admins@example.com"
|
+-attribute: inetAssociatedDnsDomain
| value: "example.com"
| value: "2.0.192.in-addr.arpa"
|
+-attribute: inetAssociatedIpv4Network
value: "192.0.2.0/24"
Hall I-D Expires: December 2003 [page 5]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
Figure 1: The entry for the admins@example.com contact in the
dc=netsol,dc=com partition.
5. Query Processing Rules
Queries for contact entries have several special requirements, as
discussed in the following sections.
Refer to [FIRS-CORE] for general information about FIRS queries.
5.1. Query Pre-Processing
Clients MUST ensure that the query input is normalized according
to the rules specified in section 3 before the input is used as
the assertion value to the resulting LDAP query.
The authoritative partition for a contact entry is determined by
mapping the domain element of a normalized email address to a
sequence of domainComponent labels.
Since the domainComponent attribute is restricted to seven-bit
characters, the domain element MUST be converted to its IDNA form
using the "ToASCII" conversion operation specified in [RFC3490],
with the "UseSTD3ASCIIRules" flag disabled (FIRS applications MAY
reuse the output from the conversion performed in step 3.c if the
entire conversion process is known to have completed
successfully). The resulting sequence of ASCII labels are used to
form the domainComponent sequence which represents the
authoritative partition for the email address.
As a simple example, "admins@example.com" would be mapped to the
"dc=example,dc=com" authoritative partition, with this partition
being used to seed the query process.
5.2. Query Bootstrapping
FIRS clients MUST use the bottom-up bootstrap model by default for
contact queries. As such, the search base for default queries
would be set to the complete sequence of domainComponent relative
distinguished names of the authoritative partition.
FIRS clients MAY use the targeted or top-down bootstrap models for
queries if necessary or desirable. However, it is not likely that
Hall I-D Expires: December 2003 [page 6]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
entries will be found for all possible contacts using these models
(the "dc=com" partition is not likely to have entries for all of
the possible contacts with mailboxes in the "com" hierarchy, for
example). As such, the bottom-up bootstrap model will be the most
useful in most cases, and MUST be used by default.
Note that registration bodies can allocate email addresses within
their own managed portion of the DNS namespace if predictability
is at a premium. For example, a registrar could assign
"user@registrar.com" email addresses to the contact entries that
it creates, thereby ensuring that the contact entries are always
locatable and managed.
5.3. LDAP Matching
FIRS clients MUST specify equalityMatch matching filters in LDAP
searches for contact entries.
In order to ensure that all of the relevant entries are found
(including any referrals), the search filters for these resources
MUST specify the inetOrgPerson object class and the naming element
of the resource as a distinguished name attribute. For example,
"(&(objectclass=inetOrgPerson)(cn:dn:admins@example.com))" with a
search base of "cn=inetResources,dc=netsol,dc=com" would find all
of the inetOrgPerson object class entries with a relative
distinguished name of "cn=admins@example.com" in the
"dc=netsol,dc=com" partition.
The matching filters defined in this specification MUST be
supported by FIRS clients and servers. FIRS servers MAY support
additional sub-string filters, soundex filters, or any other
filters they wish (these may be required to support generic LDAP
clients), although FIRS clients MUST NOT expect any additional
filters to be available.
5.4. Example Query
The following example assumes that the user has specified
"admins@example.com" as the query value:
a. Normalize the input, which is "admins@example.com" in this
case.
b. Determine the authoritative partition, which is
"dc=example,dc=com" in this case. By default, queries for
Hall I-D Expires: December 2003 [page 7]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
contacts use the bottom-up model, meaning that the fully-
qualified distinguished name of "dc=example,dc=com" will be
used.
c. Determine the search base for the query, which will be
"cn=inetResources,dc=example,dc=com" if the defaults are
used.
d. Initiate a DNS lookup for the SRV resource records
associated with "_ldap._tcp.example.com." For the purpose
of this example, assume that this lookup succeeds, with the
DNS response message indicating that "firs.example.com" is
the preferred LDAP server.
e. Submit an LDAPv3 query to the specified server, using
"(&(objectClass=inetOrgPerson)(cn:dn:admins@example.com))"
as the matching filter,
"cn=inetResources,dc=example,dc=com" as the search base,
and the global query defaults defined in [FIRS-CORE].
f. Assume that no referrals are received. Display the answer
data which has been received and exit the query.
6. Security Considerations
Security considerations are discussed in [FIRS-ARCH].
7. IANA Considerations
IANA considerations are discussed in [FIRS-ARCH].
8. Author's Addresses
Eric A. Hall
ehall@ehsco.com
9. Normative References
[RFC2247] Kille, S., Wahl, M., Grimstad, A., Huber, R.,
and Sataluri, S. "Using Domains in LDAP/X.500
DNs", RFC 2247, January 1998.
Hall I-D Expires: December 2003 [page 8]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
[RFC2251] Wahl, M., Howes, T., and Kille, S.
"Lightweight Directory Access Protocol (v3)",
RFC 2251, December 1997.
[RFC2252] Wahl, M., Coulbeck, A., Howes, T., and Kille,
S. "Lightweight Directory Access Protocol
(v3): Attribute Syntax Definitions", RFC 2252,
December 1997.
[RFC2254] Howes, T. "The String Representation of LDAP
Search Filters", RFC 2254, December 1997.
[RFC2798] Smith, M. "Definition of the inetOrgPerson
LDAP Object Class", RFC 2798, April 2000.
[FIRS-ARCH] Hall, E. "The Federated Internet Registry
Service: Architecture and Implementation
Guide", draft-ietf-crisp-firs-arch-00, May
2003.
[FIRS-ASN] Hall, E. "Defining and Locating Autonomous
System Numbers in the Federated Internet
Registry Service", draft-ietf-crisp-firs-asn-
00, May 2003.
[FIRS-CONTCT] Hall, E. "Defining and Locating Contact
Persons in the Federated Internet Registry
Service", draft-ietf-crisp-firs-contact-00,
May 2003.
[FIRS-CORE] Hall, E. "The Federated Internet Registry
Service: Core Elements", draft-ietf-crisp-
firs-core-00, May 2003.
[FIRS-DNS] Hall, E. "Defining and Locating DNS Domains in
the Federated Internet Registry Service",
draft-ietf-crisp-firs-dns-00, May 2003.
[FIRS-DNSRR] Hall, E. "Defining and Locating DNS Resource
Records in the Federated Internet Registry
Service", draft-ietf-crisp-firs-dnsrr-00, May
2003.
[FIRS-IPV4] Hall, E. "Defining and Locating IPv4 Address
Blocks in the Federated Internet Registry
Service", draft-ietf-crisp-firs-ipv4-00, May
2003.
[FIRS-IPV6] Hall, E. "Defining and Locating IPv6 Address
Blocks in the Federated Internet Registry
Hall I-D Expires: December 2003 [page 9]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
Service", draft-ietf-crisp-firs-ipv6-00, May
2003.
10. Acknowledgments
Funding for the RFC editor function is currently provided by the
Internet Society.
Portions of this document were funded by Verisign Labs.
The first version of this specification was co-authored by Andrew
Newton of Verisign Labs, and subsequent versions continue to be
developed with his active participation.
11. Changes from Previous Versions
draft-ietf-crisp-fir-contact-00:
* Restructured the document set.
* "Attribute references" have been eliminated from the
specification. All referential attributes now provide
actual data instead of URL pointers to data. Clients that
wish to retrieve these values will need to start new
queries using the data values instead of URLs.
draft-ietf-crisp-lw-user-01:
* Removed references to LDAPS (LDAP-over-SSL), which is not a
standards-track protocol.
* Added a discussion on localization considerations.
* Moved attribute-specific security requirements to the
Security section.
12. Full Copyright Statement
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished
to others, and derivative works that comment on or otherwise
explain it or assist in its implementation may be prepared,
copied, published and distributed, in whole or in part, without
Hall I-D Expires: December 2003 [page 10]
Internet Draft draft-ietf-crisp-firs-contact-00.txt May 2003
restriction of any kind, provided that the above copyright notice
and this paragraph are included on all such copies and derivative
works. However, this document itself may not be modified in any
way, such as by removing the copyright notice or references to the
Internet Society or other Internet organizations, except as needed
for the purpose of developing Internet standards in which case the
procedures for copyrights defined in the Internet Standards
process must be followed, or as required to translate it into
languages other than English.
The limited permissions granted above are perpetual and will not
be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on
an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Hall I-D Expires: December 2003 [page 11] | PAFTECH AB 2003-2026 | 2026-04-24 01:33:39 |