+----------------------------------------------------------------------+
| PolicyIPv6AddrValue | pcelsIPv6AddrValueAuxClass |
+----------------------------------------------------------------------+
| PolicyMACAddrValue | pcelsMACAddrValueAuxClass |
+----------------------------------------------------------------------+
| PolicyStringValue | pcelsStringValueAuxClass |
+----------------------------------------------------------------------+
| PolicyBitStringValue | pcelsBitStringValueAuxClass |
+----------------------------------------------------------------------+
| PolicyIntegerValue | pcelsIntegerValueAuxClass |
+----------------------------------------------------------------------+
| PolicyBooleanValue | pcelsBooleanValueAuxClass |
+----------------------------------------------------------------------+
| PolicyRoleCollection | pcelsRoleCollection |
+----------------------------------------------------------------------+
| ReusablePolicyContainer | pcelsReusableContainer |
| | pcelsReusableContainerAuxClass |
| | pcelsReusableContainerInstance |
+----------------------------------------------------------------------+
| FilterEntryBase | pcelsFilterEntryBase |
+----------------------------------------------------------------------+
| IPHeadersFilter | pcelsIPHeadersFilter |
+----------------------------------------------------------------------+
| 8021Filter | pcels8021Filter |
+----------------------------------------------------------------------+
| FilterList | pcelsFilterListAuxClass |
+----------------------------------------------------------------------+
Figure 2. Mapping of Information Model Extension Classes to LDAP
The pcelsVendorVariableAuxClass and pcelsVendorValueAuxClass classes
are not mapped from [PCIM_EXT]. These classes are introduced in this
document as a new extension mechanism for vendor-specific policy
variables and values that have not been specifically modeled. Just
like for any other schema elements defined in this document or in
[PCLS], a particular submodel schema generally will not need to use
vendor specific variable and value classes. Submodel schemas SHOULD
apply the recommendations of section 5.10 of [PCIM_EXT] with regards
to the supported and unsupported elements.
4.2. Summary of Association Mappings
The associations in the information model map to one or more of the
following options:
1. Attributes that reference DNs (Distinguished Names)
2. Directory Information Tree (DIT) containment
(i.e., superior-subordinate relationships) in LDAP
3. Auxiliary class attachment
4. Association object classes and attributes that reference DNs
The details of this mapping are discussed case by case in section 5.
+----------------------------------------------------------------------+
| Information Model Association | LDAP Attribute/Class |
+----------------------------------------------------------------------+
| PolicySetComponent | pcelsPolicySetComponentList in |
| | pcelsPolicySet and |
| | pcelsPolicySetDN in |
| | pcelsPolicySetAsociation |
+----------------------------------------------------------------------+
| PolicySetInSystem | DIT Containment and |
| | pcelsPolicySetDN in |
| | pcelsPolicySetAsociation |
+----------------------------------------------------------------------+
| PolicyGroupInSystem | DIT Containment and |
| | pcelsPolicySetDN in |
| | pcelsPolicySetAsociation |
+----------------------------------------------------------------------+
| PolicyRuleInSystem | DIT Containment and |
| | pcelsPolicySetDN in |
| | pcelsPolicySetAsociation |
+----------------------------------------------------------------------+
| PolicyConditionStructure | pcimConditionDN in |
| | pcelsConditionAssociation |
+----------------------------------------------------------------------+
| PolicyConditionInPolicyRule | pcelsConditionList in |
| | pcelsRule and |
| | pcimConditionDN in |
| | pcelsConditionAssociation |
+----------------------------------------------------------------------+
| PolicyConditionInPolicyCondition | pcelsConditionList in |
| | pcelsCompoundConditionAuxClass |
| | and pcimConditionDN in |
| | pcelsConditionAssociation |
+----------------------------------------------------------------------+
| PolicyActionStructure | pcimActionDN in |
| | pcelsActionAssociation |
+----------------------------------------------------------------------+
| PolicyActionInPolicyRule | pcelsActionList in |
| | pcelsRule and |
| | pcimActionDN in |
| | pcelsActionAssociation |
+----------------------------------------------------------------------+
| PolicyActionInPolicyAction | pcelsActionList in |
| | pcelsCompoundActionAuxClass |
| | and pcimActionDN in |
| | pcelsActionAssociation |
+----------------------------------------------------------------------+
| PolicyVariableInSimplePolicy | pcelsVariableDN in |
| Condition | pcelsSimpleConditionAuxClass |
+----------------------------------------------------------------------+
| PolicyValueInSimplePolicy | pcelsValueDN in |
| Condition | pcelsSimpleConditionAuxClass |
+----------------------------------------------------------------------+
| PolicyVariableInSimplePolicy | pcelsVariableDN in |
| Action | pcelsSimpleActionAuxClass |
+----------------------------------------------------------------------+
| PolicyValueInSimplePolicyAction | pcelsValueDN in |
| | pcelsSimpleActionAuxClass |
+----------------------------------------------------------------------+
| ReusablePolicy | DIT containment |
+----------------------------------------------------------------------+
| ExpectedPolicyValuesForVariable | pcelsExpectedValueList in |
| | pcelsVariable |
+----------------------------------------------------------------------+
| ContainedDomain | DIT containment or |
| | pcelsReusableContainerList in |
| | pcelsReusableContainer |
+----------------------------------------------------------------------+
| EntriesInFilterList | pcelsFilterEntryList in |
| | pcelsFilterListAuxClass |
+----------------------------------------------------------------------+
| ElementInPolicyRoleCollection | DIT containment or |
| | pcelsElementList in |
| | pcelsRoleCollection |
+----------------------------------------------------------------------+
| PolicyRoleCollectionInSystem | DIT Containment |
+----------------------------------------------------------------------+
Figure 3. Mapping of Information Model Extension Associations to LDAP
Two [PCIM_EXT] associations are mapped to DIT containment:
- PolicyRoleCollectionInSystem is a weak association and weak
associations map well to DIT containment [CIM_LDAP] (without
being limited to this mapping). In the absence of additional
constraints, DIT containment is chosen here as the optimal
association mapping.
- ReusablePolicy is mapped to DIT containment for scalability
reasons. It is expected that applications will associate a
large number of policy instances to a ReusablePolicyContainer
and DIT containment is a type of association that scales well.
4.3. Summary of Changes Since PCLS
This section provides an overview of the changes relative to [PCLS]
defined in this document:
1. The concept of a set of policies is introduced by two new object
classes: pcelsPolicySet and pcelsPolicySetAssociation. These
classes enable the aggregation and relative prioritization of
policies (rules and/or groups). The attribute pcelsPriority is
used by pcelsPolicySetAssociation instances to indicate the
priority of a policy relative to the other policies aggregated by
the same set. Applications may use this attribute to apply
appropriate ordering to the aggregated policies. This new policy
aggregation mechanism provides an alternative to the aggregation
mechanism defined by [PCLS] (that defines
pcimRuleContainmentAuxClass and/or pcimGroupContainmentAuxClass
for attaching components to a pcimGroup).
2. The attribute pcimRoles defined by [PCLS] is used here by the
pcelsPolicySet object class. Thus, the role based policy
selection mechanism is extended to all the subclasses of
pcelsPolicySet.
3. A new attribute pcelsDecisionStrategy is added on the
pcelsPolicySet class as a mapping from the decision mechanism.
4. A new class pcelsGroup (with two subclasses), implements the
modified semantics of the PolicyGroup in accordance with
[PCIM_EXT]. This new class inherits from its superclass
pcelsPolicySet the ability to aggregate (with relative priority)
other policy rules or groups.
5. A new class pcelsRule (with two subclasses), implements the
modified semantics of the PolicyRule in accordance with
[PCIM_EXT]. It does not include an absolute priority attribute,
but instances of non-abstract subclasses of pcelsRule can be
prioritized relative to each other within a System (behavior
inherited from its superclass: pcelsPolicySet). The pcelsRule
class also inherits from pcelsPolicySet the ability to aggregate
other policy rules or groups, and thus, the ability to construct
nested rule structures of arbitrary complexity.
6. A new attribute pcelsExecutionStrategy is added to the pcelsRule
and pcelsCompoundActionAuxClass classes to allow the
specification of the expected behavior in case of multiple
actions aggregated by a rule or by a compound action.
7. Compound Conditions: The pcelsCompoundConditionAuxClass class is
added in order to map the CompoundPolicyCondition class. A new
class, pcelsConditionAssociation is used to aggregate policy
conditions in a pcelsCompoundConditionAuxClass. The same class
is also used to aggregate policy conditions in a pcelsRule.
8. Compound Actions: The pcelsCompoundActionAuxClass class is added
in order to map the CompoundPolicyAction class. A new class,
pcelsActionAssociation is used to aggregate policy actions in a
pcelsCompoundActionAuxClass. The same class is also used to
aggregate policy actions in a pcelsRule.
9. Simple Conditions, Simple Actions, Variables and Values: The
simple condition, simple action, variable and value classes
defined by [PCIM_EXT] are directly mapped to LDAP object classes.
These are: pcelsSimpleConditionAuxClass,
pcelsSimpleActionAuxClass, pcelsVariable and its subclasses, and
pcelsValueAuxClass and its subclasses.
10. A general extension mechanism is introduced for representing
policy variables and values that have not been specifically
modeled. The mechanism is intended for vendor-specific
extensions.
11. Reusable Policy Repository: A new class (with two subclasses),
pcelsReusableContainer is created as a subclass of
pcimRepository. While maintaining compatibility with older
[PCLS] implementations, the addition of this class acknowledges
the intent of [PCIM_EXT] to avoid the potential for confusion
with the Policy Framework component named Policy Repository.
The new class enables many-to-many associations between reusable
policy containers.
12. The ReusablePolicy association defined in [PCIM_EXT] is realized
through subordination to an instance of a non-abstract subclass
of pcelsReusableContainer. Thus, reusable policy components
(groups, rules, conditions, actions, variables and values) may
be defined as stand-alone entries or stand-alone groups of
related entries subordinated (DIT contained) to a
pcelsReusableContainer.
13. Device level filter classes are added to the schema.
14. The pcelsRoleCollection class is added to the schema to allow
the association of policy roles to resources represented as LDAP
entries.
4.4. Relationship to PCLS Classes
Several [PCLS] classes are used in this document to derive other
classes. If a PCELS application requires a functionality provided by
any of derived classes, then the [PCLS] class MUST also be supported
by PCELS implementations. These classes are:
pcimPolicy
pcimRuleConditionAssociation
pcimRuleActionAssociation
pcimConditionAuxClass
pcimActionAuxClass
pcimRepository
Other [PCLS] classes are neither derived to nor superseded by classes
defined in this document. If a PCELS application requires a
functionality provided by any of these classes, then the [PCLS] class
SHOULD be used. These classes are:
pcimRuleValidityAssociation
pcimTPCAuxClass
pcimConditionVendorAuxClass
pcimActionVendorAuxClass
pcimPolicyInstance
pcimElementAuxClass
pcimSubtreesPtrAuxClass
Among the classes defined in this document some implement concepts
that supersede the concepts implemented by similar [PCLS] classes.
PCELS implementations MAY support such [PCLS] classes. These classes
are:
pcimGroup and its subclasses
pcimRule and its subclasses
pcimGroupContainmentAuxClass
pcimRuleContainmentAuxClass
the subclasses of pcimRepository
4.5. Impact on Existing Implementations of the Policy Core LDAP Schema
In general, the intent of PCELS is to extend the functionality
offered by the Policy Core LDAP Schema. For the most part, the
compatibility with [PCLS] is preserved. The few cases in which
compatibility cannot be achieved due to fundamental changes imposed
by [PCIM_EXT], are defined here as alternatives to the original
implementation.
PCELS does not obsolete nor deprecate the concepts implemented by
[PCLS]. The new LDAP schema items are defined in this document in a
way that avoids, to the extent possible, interference with the
normal operation of a reasonably well-executed implementation of
[PCLS]. The intent is to permit at least a harmless coexistence of
the two models in the same data repository.
However, it should be noted that the PCELS introduces the following
changes that may have an impact on some [PCLS] implementations:
1. Some attributes originally used only by pcimRule or pcimGroup are
now also used by classes unknown to [PCLS] implementations
(pcelsPolicySet, pcelsRule and pcelsGroup). In particular, the
attribute pcimRoles is also used by pcelsPolicySet for role based
policy selection.
2. Condition and action association classes originally used by only
pcimRule are now used (through subclasses) by pcelsRule as well.
3. pcimRepository containers may include entries of types unknown to
[PCLS] implementations.
When the choice exists, PCELS implementations SHOULD support the new
schema and MAY also support the one defined by [PCLS]. For example,
if PolicyRule support is required, an implementation SHOULD be able
to read or read-write (as applicable) pcelsRule entries. The same
implementation MAY be able to read or read-write pcimRule.
4.6. The Association of PolicyVariable and PolicyValues
to PolicySimpleCondition and PolicySimpleAction
A PolicySimpleCondition, as well as a PolicySimpleAction, includes a
single PolicyValue and a single PolicyVariable. Each of them can be
attached or referenced by a DN.
The attachment helps create compact PolicyCondition and PolicyAction
definitions that can be efficiently provisioned and retrieved from
the repository. On the other hand, referenced PolicyVariables and
PolicyValues instances can be reused in the construction of multiple
policies and permit an administrative partitioning of the data and
policy definitions.
4.7. The Aggregation of PolicyRules and PolicyGroups in PolicySets
In [PCIM_EXT], the two aggregations PolicyGroupInPolicyGroup and
PolicyRuleInPolicyGroup, are combined into a single aggregation
PolicySetComponent. This aggregation and the capability of
association between a policy and the ReusablePolicyContainer offer
new possibilities of reusability. Furthermore, these aggregations
introduce new semantics representing the execution of one PolicyRule
within the scope of another PolicyRule.
Since PolicySet is defined in [PCIM_EXT], it is mapped in this
document to a new class pcelsPolicySet in order to provide an
abstraction for a set of policy rules or groups. The aggregation
class PolicySetComponent in [PCIM_EXT] is mapped to a multi-value
attribute pcelsPolicySetList in the pcelsPolicySet class and the
attribute pcelsPolicySetDN in the pcelsPolicySetAssociation. These
attributes refer to the nested rules and groups.
It is possible to store a rule/group nested in another rule/group in
two ways. The first way is to define the nested rule/group as
specific to the nesting rule/group. The second way is to define the
nested rules/groups as reusable.
First case: Specific nested sets (rules/groups).
+----------+
|Rule/Group|
| |
+-----|- -|-----+
| +----------+ |
| * * |
| * * |
| **** **** |
| * * |
v * * v
+-----------+ +-----------+
| SA1+Set1 | | SA2+Set2 |
+-----------+ +-----------+
+------------------------------+
|LEGEND: |
| ***** DIT containment |
| + auxiliary attachment |
| ----> DN reference |
+------------------------------+
#: Number.
Set#: pcelsRuleAuxClass or pcelsGroupAuxClass auxiliary class.
SA#: pcelsPolicySetAssocation structural class.
Figure 4. Policy Set with Specific Components
The nesting pcelsPolicySet refers to instances of
pcelsPolicySetAssociation using the attribute pcelsPolicySetList.
These structural association classes are subordinated (DIT contained)
to an instance of a non-abstract subclass of pcelsPolicySet and
represent the association between the PolicySet and its nested
rules/groups. The nested instances of auxiliary subclasses of
pcelsPolicySet are attached to the association entries.
Second case: Reusable nested sets (rules/groups).
+----------+ +-------------+
|Rule/Group| | ContainerX |
+-|- -|--+ | |
| +----------+ | +-------------+
| * * | * *