when in fact the strictly correct expression would be "instances of
objects that belong to non-abstract subclasses of <class_name>". The
omission is intentional; it makes the text easier to read.
5.1. The Abstract Class pcelsPolicySet
The pcelsPolicySet class represents a set of policies with a common
decision strategy and a common set of policy roles. This class
together with the pcelsPolicySetAssociation class defined in a
subsequent section of this document provide sufficient information to
allow applications to apply appropriate ordering to a set of
policies. The pcelsPolicySet is mapped from the PolicySet class
[PCIM_EXT]. The pcelsPolicySet class is an abstract object class and
it is derived from the pcimPolicy class [PCLS].
The pcelsPolicySetList attribute of a pcelsPolicySet instance
references subordinated pcelsPolicySetAssociation entries. The
aggregated pcelsPolicySet instances are either attached to the
pcelsPolicySetAssociation entries as auxiliary object classes or
referenced by the pcelsPolicySetAssociation entries using the
pcelsPolicySetDN attribute.
The pcelsPolicySet class is defined as follows:
( 1.3.6.1.1.9.1.1
NAME ’pcelsPolicySet’
DESC ’Set of policies’
SUP pcimPolicy
ABSTRACT
MAY ( pcelsPolicySetName
$ pcelsDecisionStrategy
$ pcimRoles
$ pcelsPolicySetList )
)
One of the attributes of the pcelsPolicySet class, pcimRoles is
defined in the section 5.3 of [PCLS]. In the pcelsPolicySet class
the pcimRole attribute preserves its syntax and semantics as defined
by [PCLS] and [PCIM].
The pcelsPolicySetName attribute type may be used as naming attribute
for pcelsPolicySet entries. This attribute type is of syntax
Directory String [LDAP_SYNTAX]. It has an equality matching rule of
caseIgnoreMatch, an ordering matching rule of caseIgnoreOrderingMatch
and a substrings matching rule of caseIgnoreSubstringsMatch
[LDAP_SYNTAX]. Attributes of this type can only have a single value.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.1
NAME ’pcelsPolicySetName’
DESC ’User-friendly name of a policy set’
EQUALITY caseIgnoreMatch
ORDERING caseIgnoreOrderingMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
)
The pcelsDecisionStrategy attribute type indicates the evaluation
method for the policies aggregated in the policy set. It is mapped
from the PolicySet.PolicyDecisionStrategy property [PCIM_EXT]. This
attribute type is of syntax Integer [LDAP_SYNTAX]. It has an
equality matching rule of integerMatch [LDAP_SYNTAX] and an ordering
matching rule of integerOrderingMatch [LDAP_MATCH]. Attributes of
this type can only have a single value. The only allowed values for
attributes of this type are 1 (FirstMatching) and 2 (AllMatching).
If this attribute is missing from a pcelsPolicySet instance,
applications MUST assume a FirstMatching decision strategy for the
policy set.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.2
NAME ’pcelsDecisionStrategy’
DESC ’Evaluation method for the components of a pcelsPolicySet’
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
)
The pcelsPolicySetList attribute type is used in the realization of
the PolicySetComponent association [PCIM_EXT]. This attribute type
is of syntax DN [LDAP_SYNTAX]. It has an equality matching rule of
distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can
have multiple values. The only allowed values for pcelsPolicySetList
attributes are DNs of pcelsPolicySetAssociation entries. In a
pcelsPolicySet, the pcelsPolicySetList attribute represents the
associations between this policy set and its components.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.3
NAME ’pcelsPolicySetList’
DESC ’Unordered set of DNs of pcelsPolicySetAssociation entries’
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)
Note: A pcelsPolicySet instance aggregates other pcelsPolicySet
instances using pcelsPolicySetAssociation entries (defined in the
next section). Applications can sort the components of a
pcelsPolicySet using attributes of the pcelsPolicySetAssociation
entries. However, implementations should not expect the LDAP data
store to provide a useful ordering of the pcelsPolicySetList values
in a pcelsPolicySet instance or to return sets of matching
pcelsPolicySetAssociation entries in a meaningful order. Instead,
applications SHOULD implement their own means for post-retrieval
ordering of policy rules/groups based on
pcelsPolicySetAssociation.pcelsPriority values.
5.2. The Structural Class pcelsPolicySetAssociation
The pcelsPolicySetAssociation class is used to associate PolicySet
instances [PCIM_EXT] to other entries. pcelsPolicySetAssociation
entries are always subordinated to the aggregating entry. When
subordinated to an instance of pcelsPolicySet,
pcelsPolicySetAssociation realizes a PolicySetComponent association
[PCIM_EXT]. When subordinated to an instance of dlm1System
[CIM_LDAP], pcelsPolicySetAssociation realizes a PolicySetInSystem
association [PCIM_EXT].
The pcelsPolicySetAssociation class is a structural object class and
it is derived from the pcimPolicy class [PCLS].
The aggregation of a reusable pcelsPolicySet instance is realized via
the pcelsPolicySetDN attribute. A non-reusable pcelsPolicySet
instance is attached (as auxiliary subclass of pcelsPolicySet)
directly to the pcelsPolicySetAssociation entry.
When reading a pcelsPolicySetAssociation instance that has a
pcelsPolicySet attached, the attribute pcelsPolicySetDN MUST be
ignored. Applications SHOULD remove the pcelsPolicySetDN value from
a pcelsPolicySetAssociation upon attachment of a pcelsPolicySet to
the entry.
The pcelsPolicySetAssociation class is defined as follows:
( 1.3.6.1.1.9.1.2
NAME ’pcelsPolicySetAssociation’
DESC ’Associates a policy set to an aggregating entry’
SUP pcimPolicy
STRUCTURAL
MUST ( pcelsPriority )
MAY ( pcelsPolicySetName
$ pcelsPolicySetDN )
)
The pcelsPriority attribute type indicates the priority of a policy
set component. This attribute type is of syntax Integer
[LDAP_SYNTAX]. It has an equality matching rule of integerMatch
[LDAP_SYNTAX] and an ordering matching rule of integerOrderingMatch
[LDAP_MATCH]. Attributes of this type can only have single values.
The only allowed values for attributes of this type are non-negative
integers. Within the set of pcelsPolicySetAssociation entries
directly subordinated to a pcelsPolicySet or a dlm1System [CIM_LDAP],
the pcelsPriority values MUST be unique.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.4
NAME ’pcelsPriority’
DESC ’Priority of a component’
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
)
The pcelsPolicySetDN attribute type is used in the aggregation of
PolicySet instances [PCIM_EXT]. This attribute type is of syntax DN
[LDAP_SYNTAX]. It has an equality matching rule of
distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can
only have a single values. The only allowed values for
pcelsPolicySetDN attributes are DNs of pcelsPolicySet entries.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.5
NAME ’pcelsPolicySetDN’
DESC ’DN of a pcelsPolicySet entry’
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
SINGLE-VALUE
)
5.3. The Three Policy Group Classes
The pcelsGroup class is the base class for representing a policy
group. It is mapped from the modified PolicyGroup class [PCIM_EXT].
The pcelsGroup class is derived from the pcelsPolicySet class. To
maximize flexibility, the pcelsGroup class is defined as abstract.
An auxiliary subclass pcelsGroupAuxClass enables the attachment of a
policy group to an existing entry, while a structural subclass
pcelsGroupInstance permits the representation of a policy group as a
standalone entry.
The pcelsGroup class is defined as follows:
( 1.3.6.1.1.9.1.3
NAME ’pcelsGroup’
DESC ’Base class for representing a policy group’
SUP pcelsPolicySet
ABSTRACT
MAY ( pcimGroupName )
)
The pcelsGroupAuxClass class is defined as follows:
( 1.3.6.1.1.9.1.4
NAME ’pcelsGroupAuxClass’
DESC ’Auxiliary class for representing a policy group’
SUP pcelsGroup
AUXILIARY
)
The pcelsGroupInstance class is defined as follows:
( 1.3.6.1.1.9.1.5
NAME ’pcelsGroupInstance’
DESC ’Structural class for representing a policy group’
SUP pcelsGroup
STRUCTURAL
)
The pcimGroupName attribute type used by the pcelsGroup class is
defined in the section 5.2 of [PCLS]. In the pcelsGroup object
class, this attribute preserves its syntax and semantics as defined
by [PCLS] and [PCIM].
Note: PCELS implementations SHOULD support pcelsGroup and its two
subclasses and MAY also support pcimGroup and its two subclasses
[PCLS]. Applications that choose to support pcelsGroup and its two
subclasses MUST use the aggregation mechanism provided by
pcelsPolicySetAssociation for aggregating policy groups or policy
rules in policy groups represented as instances of pcelsGroup.
5.4. The Three Policy Rule Classes
The pcelsRule class is the base class for representing a policy rule.
It is mapped from the modified PolicyRule class [PCIM_EXT]. The
pcelsRule class is derived from the pcelsPolicySet class. To
maximize flexibility, the pcelsRule class is defined as abstract. An
auxiliary subclass pcelsRuleAuxClass enables the attachment of a
policy rule to an existing entry, while a structural subclass
pcelsRuleInstance permits the representation of a policy rule as a
standalone entry.
When reading a pcelsRule instance that has a pcimConditionAuxClass
attached, from the policy rule perspective the attribute
pcelsConditionList MUST be ignored. For example, if present, the
attribute MUST NOT be considered an association between this policy
rule and a policy condition. Such situations may occur, for example,
when a pcelsCompoundConditionAuxClass is attached to a pcelsRule
instance.
When reading a pcelsRule instance that has a pcimActionAuxClass
attached, from the policy rule perspective the attribute
pcelsActionList MUST be ignored. For example, if present, the
attribute MUST NOT be considered an association between this policy
rule and a policy action. Such situations may occur, for example,
when a pcelsCompoundActionAuxClass is attached to a pcelsRule
instance.
The pcelsRule class is defined as follows:
( 1.3.6.1.1.9.1.6
NAME ’pcelsRule’
DESC ’Base class for representing a policy rule’
SUP pcelsPolicySet
ABSTRACT
MAY ( pcimRuleName
$ pcimRuleEnabled
$ pcimRuleUsage
$ pcimRuleMandatory
$ pcelsRuleValidityPeriodList
$ pcelsConditionListType
$ pcelsConditionList
$ pcelsActionList
$ pcelsSequencedActions
$ pcelsExecutionStrategy )
)
The pcelsRuleAuxClass class is defined as follows:
( 1.3.6.1.1.9.1.7
NAME ’pcelsRuleAuxClass’
DESC ’Auxiliary class for representing a policy rule’
SUP pcelsRule
AUXILIARY
)
The pcelsRuleInstance class is defined as follows:
( 1.3.6.1.1.9.1.8
NAME ’pcelsRuleInstance’
DESC ’Structural class for representing a policy rule’
SUP pcelsRule
STRUCTURAL
)
Four of the attributes used by the pcelsRule class are defined in the
section 5.3 of [PCLS]. These attributes are: pcimRuleName,
pcimRuleEnabled, pcimRuleUsage and pcimRuleMandatory. In the
pcelsRule object class, these attributes preserve their syntax and
semantics as defined by [PCLS] and [PCIM].
The attributes pcimRuleValidityPeriodList, pcimRuleConditionListType,
pcimRuleConditionList, pcimRuleActionList and
pcimRuleSequencedActions defined in [PCLS] are not used by pcelsRule.
Instead, this class uses the new attributes
pcelsRuleValidityPeriodList, pcelsConditionListType,
pcelsConditionList, pcelsActionList and pcelsSequencedActions.
Except for pcelsRuleValidityPeriodList, the new attributes are also
used for similar purpose by either pcelsCompoundConditionAuxClass or
pcelsCompoundActionAuxClass.
The pcelsRuleValidityPeriodList attribute type is used in the
realization of the PolicyRuleValidityPeriod association ([PCIM_EXT]
and [PCIM]). This attribute type is of syntax DN [LDAP_SYNTAX]. It
has an equality matching rule of distinguishedNameMatch
[LDAP_SYNTAX]. Attributes of this type can have multiple values.
The only allowed values for pcelsRuleValidityPeriodList attributes
are DNs of pcimRuleValidityAssociation entries. In a pcelsRule, the
pcelsRuleValidityPeriodList attribute represents the associations
between this policy rule and its time period conditions.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.62
NAME ’pcelsRuleValidityPeriodList’
DESC ’Unordered set of DNs of pcimRuleValidityAssociation entries’
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)
The pcelsConditionListType attribute type indicates whether the set
of aggregated conditions is in disjunctive or conjunctive normal
form. It is mapped from the PolicyRule.ConditionListType property
[PCIM] (identical to the CompoundPolicyCondition.ConditionListType
property defined in [PCIM_EXT]). This attribute type is of syntax
Integer [LDAP_SYNTAX]. It has an equality matching rule of
integerMatch [LDAP_SYNTAX] and an ordering matching rule of
integerOrderingMatch [LDAP_MATCH]. Attributes of this type can only
have a single value. The only allowed values for attributes of this
type are 1 (Disjunctive) and 2 (Conjunctive). If this attribute is
missing from a pcelsRule instance, applications MUST assume that the
set of aggregated conditions is in disjunctive normal form.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.6
NAME ’pcelsConditionListType’
DESC ’Indicates the type of condition aggregation’
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
)
The pcelsConditionList attribute type is used in the realization of
the PolicyConditionStructure association [PCIM_EXT]. This attribute
type is of syntax DN [LDAP_SYNTAX]. It has an equality matching rule
of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can
have multiple values. The only allowed values for pcelsConditionList
attributes are DNs of pcelsConditionAssociation entries. In a
pcelsRule, the pcelsConditionList attribute represents the
associations between this policy rule and its conditions.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.7
NAME ’pcelsConditionList’
DESC ’Unordered set of DNs of pcelsConditionAssociation entries’
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)
The pcelsActionList attribute type is used in the realization of the
PolicyActionStructure association [PCIM_EXT]. This attribute type is
of syntax DN [LDAP_SYNTAX]. It has an equality matching rule of
distinguishedNameMatch [LDAP_SYNTAX]. Attributes of this type can
have multiple values. The only allowed values for pcelsActionList
attributes are DNs of pcelsActionAssociation entries. In a
pcelsRule, the pcelsActionList attribute represents the associations
between this policy rule and its actions.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.8
NAME ’pcelsActionList’
DESC ’Unordered set of DNs of pcelsActionAssociation entries’
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
)
The pcelsSequencedActions attribute type indicates whether the
ordered execution of actions in an aggregate is Mandatory,
Recommended or DontCare. It is mapped from the
PolicyRule.SequencedActions property [PCIM] (identical to the
CompoundPolicyAction.SequencedActions property defined in
[PCIM_EXT]). This attribute type is of syntax Integer [LDAP_SYNTAX].
It has an equality matching rule of integerMatch [LDAP_SYNTAX] and an
ordering matching rule of integerOrderingMatch [LDAP_MATCH].
Attributes of this type can only have a single value. The only
allowed values for attributes of this type are 1 (Mandatory), 2
(Recommended) and 3 (DontCare). If this attribute is missing from a
pcelsRule instance, applications MUST assume that the ordered
execution of actions in this rule is not important (DontCare).
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.9
NAME ’pcelsSequencedActions’
DESC ’Indicates the importance of action sequencing’
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
)
The pcelsExecutionStrategy attribute type indicates whether the
actions in an aggregate are to be executed until success, all
(independent of their outcome) or until failure. It is mapped from
the PolicyRule.ExecutionStrategy property [PCIM_EXT] (identical to
the CompoundPolicyAction.ExecutionStrategy property). This attribute
type is of syntax Integer [LDAP_SYNTAX]. It has an equality matching
rule of integerMatch [LDAP_SYNTAX] and an ordering matching rule of
integerOrderingMatch [LDAP_MATCH]. Attributes of this type can only
have a single value. The only allowed values for attributes of this
type are 1 (Do until success), 2 (Do all) and 3 (Do until failure).
If this attribute is missing from a pcelsRule instance, applications
MUST assume that all the actions are to be executed (Do all).
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.10
NAME ’pcelsExecutionStrategy’
DESC ’Indicates the action execution strategy’
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
)
Note 1: Rule validity periods for an instance of pcelsRule are
realized using the attribute pcelsRuleValidityPeriodList and
pcimRuleValidityAssociation [PCLS] entries subordinated to the rule.
If DIT structure rules and name forms are written for a PCELS
implementation (as suggested in section 5.5 of [PCLS]), they would
require that an instance of the pcimRuleValidityAssociation class
have as its superior an instance of the pcelsRule class or, if
applicable, an instance of the pcimRule class. Any structure rules
and name forms that require an instance of the
pcimRuleValidityAssociation class to have as its superior only an
instance of the pcimRule class, are in conflict and MUST be removed.
Note 2: PCELS implementations SHOULD support pcelsRule and its two
subclasses and MAY also support pcimRule and its two subclasses
[PCLS]. Applications that choose to support pcelsRule and its two
subclasses MUST use the aggregation mechanism provided by
pcelsPolicySetAssociation for aggregating policy groups or policy
rules in policy rules represented as instances of pcelsRule.
5.5. The Structural Class pcelsConditionAssociation
The pcelsConditionAssociation class is used in the aggregation of
PolicyCondition instances [PCIM]. pcelsConditionAssociation entries
are always subordinated to the aggregating entry. When subordinated
to an instance of pcelsRule, the pcelsConditionAssociation entry
realizes the PolicyConditionInPolicyRule association [PCIM_EXT].
When subordinated to an instance of pcelsCompoundConditionAuxClass,
the pcelsConditionAssociation entry realizes the
PolicyConditionInPolicyCondition association [PCIM_EXT].
The pcelsConditionAssociation class is a structural object class and
it is derived from the pcimRuleConditionAssociation class [PCLS].
The aggregation of a reusable instance of pcimConditionAuxClass is
realized via the pcimConditionDN attribute. A non-reusable instance
of pcimConditionAuxClass is attached directly to the
pcelsConditionAssociation entry.
When reading a pcelsConditionAssociation entry that has a
pcimConditionAuxClass instance attached, the attribute
pcimConditionDN MUST be ignored. Applications SHOULD remove the
pcimConditionDN value from a pcelsConditionAssociation upon
attachment of a pcimConditionAuxClass to the entry.
The pcelsConditionAssociation class is defined as follows:
( 1.3.6.1.1.9.1.9
NAME ’pcelsConditionAssociation’
DESC ’Associates a policy conditions to an aggregating entry’
SUP pcimRuleConditionAssociation
STRUCTURAL
)
This class extends the semantics of the pcimRuleConditionAssociation
object class without using any new attributes. All its attributes
are inherited from the pcimRuleConditionAssociation that is defined
in section 5.4 of [PCLS].
5.6. The Structural Class pcelsActionAssociation
The pcelsActionAssociation class is used in the aggregation of
PolicyAction instances [PCIM]. pcelsActionAssociation entries are
always subordinated to the aggregating entry. When subordinated to a
pcelsRule instance, the pcelsActionAssociation entry realizes the
PolicyActionInPolicyRule association [PCIM_EXT]. When subordinated
to an instance of pcelsCompoundActionAuxClass, the
pcelsActionAssociation entry realizes the PolicyActionInPolicyAction
association [PCIM_EXT].
The pcelsActionAssociation class is a structural object class and it
is derived from the pcimRuleActionAssociation class [PCLS].
The aggregation of a reusable instance of pcimActionAuxClass is
realized via the pcimActionDN attribute. A non-reusable instance of
pcimActionAuxClass is attached directly to the pcelsActionAssociation
entry.
When reading a pcelsActionAssociation entry that has a
pcimActionAuxClass instance attached, the attribute pcimActionDN MUST
be ignored. Applications SHOULD remove the pcimActionDN value from a
pcelsActionAssociation upon attachment of a pcimActionAuxClass to the
entry.
The pcelsActionAssociation class is defined as follows:
( 1.3.6.1.1.9.1.10
NAME ’pcelsActionAssociation’
DESC ’Associates a policy conditions to an aggregating entry’
SUP pcimRuleActionAssociation
STRUCTURAL
)
This class extends the semantics of the pcimRuleActionAssociation
object class without using any new attributes. All its attributes
are inherited from the pcimRuleActionAssociation that is defined in
section 5.6 of [PCLS].
5.7. The Auxiliary Class pcelsSimpleConditionAuxClass
The pcelsSimpleConditionAuxClass class implements a Value matching
condition for a Variable. It is mapped from the
SimplePolicyCondition class [PCIM_EXT]. The
pcelsSimpleConditionAuxClass class is an auxiliary object class and
it is derived from the pcimConditionAuxClass class [PCLS].
A reusable variable/value is associated to a
pcelsSimpleConditionAuxClass via the pcelsVariableDN/pcelsValueDN
reference from the simple condition instance. A non-reusable
variable/value is associated directly as auxiliary object class to
the same entry as the pcelsSimpleConditionAuxClass instance.
When reading a pcelsSimpleConditionAuxClass instance that has an
instance of pcelsVariable attached, the attribute pcelsVariableDN
MUST be ignored. Applications SHOULD remove the pcelsVariableDN
value from a pcelsSimpleConditionAuxClass instance upon attachment of
a pcelsVariable instance to the same entry.
When reading a pcelsSimpleConditionAuxClass instance that has an
instance of pcelsValue attached, the attribute pcelsValueDN MUST be
ignored. Applications SHOULD remove the pcelsValueDN value from a
pcelsSimpleConditionAuxClass instance upon attachment of a pcelsValue
instance to the same entry.
The pcelsSimpleConditionAuxClass class is defined as follows:
( 1.3.6.1.1.9.1.11
NAME ’pcelsSimpleConditionAuxClass’
DESC ’Value matching condition for a policy variable’
SUP pcimConditionAuxClass
AUXILIARY
MAY ( pcelsVariableDN
$ pcelsValueDN )
)
The pcelsVariableDN attribute type realizes the
PolicyVariableInSimplePolicyCondition association [PCIM_EXT]. This
attribute type is of syntax DN [LDAP_SYNTAX]. It has an equality
matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of
this type can only have a single value. The only allowed values for
pcelsVariableDN attributes are DNs of pcelsVariable entries. In a
pcelsSimpleConditionAuxClass, the pcelsVariableDN attribute
represents the association between this simple policy condition and
its policy variable.
This attribute type is defined as follows:
( 1.3.6.1.1.9.2.11
NAME ’pcelsVariableDN’
DESC ’DN of a pcelsVariable entry’
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
SINGLE-VALUE
)
The pcelsValueDN attribute type realizes the
PolicyValueInSimplePolicyCondition association [PCIM_EXT]. This
attribute type is of syntax DN [LDAP_SYNTAX]. It has an equality
matching rule of distinguishedNameMatch [LDAP_SYNTAX]. Attributes of
this type can only have a single value. The only allowed values for
pcelsValueDN attributes are DNs of pcelsValueAuxClass entries. In a
pcelsSimpleConditionAuxClass, the pcelsValueDN attribute represents
the association between this simple policy condition and its policy