1/*	$NetBSD: ldap_rbac.h,v 1.2 2021/08/14 16:14:53 christos Exp $	*/
2
3#ifndef LDAP_RBAC_H
4#define LDAP_RBAC_H
5
6/* extended operations for RBAC */
7#define LDAP_RBAC_EXOP_CREATE_SESSION   "1.3.6.1.4.1.4203.555.1" /* RFC xxxx */
8#define LDAP_RBAC_EXOP_CHECK_ACCESS     "1.3.6.1.4.1.4203.555.2"
9#define LDAP_RBAC_EXOP_ADD_ACTIVE_ROLE  "1.3.6.1.4.1.4203.555.3"
10#define LDAP_RBAC_EXOP_DROP_ACTIVE_ROLE "1.3.6.1.4.1.4203.555.4"
11#define LDAP_RBAC_EXOP_DELETE_SESSION   "1.3.6.1.4.1.4203.555.5"
12#define LDAP_RBAC_EXOP_SESSION_ROLES    "1.3.6.1.4.1.4203.555.6"
13#define LDAP_RBAC_EXOP_SESSION_PERMISSIONS "1.3.6.1.4.1.4203.555.7"
14
15#define LDAP_TAG_EXOP_RBAC_SESSION_ID ((ber_tag_t)0x80U)
16#define LDAP_TAG_EXOP_RBAC_TENANT_ID ((ber_tag_t)0x81U)
17#define LDAP_TAG_EXOP_RBAC_USER_ID ((ber_tag_t)0x82U)
18#define LDAP_TAG_EXOP_RBAC_USER ((ber_tag_t)0x80U)
19#define LDAP_TAG_EXOP_RBAC_AUTHTOK ((ber_tag_t)0x83U)
20#define LDAP_TAG_EXOP_RBAC_ACTIVE_ROLE ((ber_tag_t)0xA4U)
21#define LDAP_TAG_EXOP_RBAC_OPNAME ((ber_tag_t)0x81U)
22#define LDAP_TAG_EXOP_RBAC_OBJNAME ((ber_tag_t)0x82U)
23#define LDAP_TAG_EXOP_RBAC_OBJID ((ber_tag_t)0x83U)
24#define LDAP_TAG_EXOP_RBAC_PWPOLICY_STATE ((ber_tag_t)0x85U)
25#define LDAP_TAG_EXOP_RBAC_PWPOLICY_VALUE ((ber_tag_t)0x86U)
26#define LDAP_TAG_EXOP_RBAC_ROLES ((ber_tag_t)0x04U)
27
28#define LDAP_TAG_EXOP_RBAC_USER_ID_SESS	((ber_tag_t)0x80U)
29#define LDAP_TAG_EXOP_RBAC_SESSION_ID_SESS	((ber_tag_t)0x81U)
30#define LDAP_TAG_EXOP_RBAC_ROLE_NM_SESS	((ber_tag_t)0x82U)
31
32#define RBAC_REQ_CREATE_SESSION      0
33#define RBAC_REQ_CHECK_ACCESS        1
34#define RBAC_REQ_ADD_ACTIVE_ROLE     2
35#define RBAC_REQ_DROP_ACTIVE_ROLE    3
36#define RBAC_REQ_DELETE_SESSION      4
37#define RBAC_REQ_SESSION_PERMISSIONS 5
38#define RBAC_REQ_SESSION_ROLES       6
39
40/* defines for password policy */
41#define RBAC_BIND_NEW_AUTHTOK_REQD 1
42
43#define RBAC_PASSWORD_GOOD 0
44#define RBAC_PASSWORD_EXPIRATION_WARNING 11
45#define RBAC_PASSWORD_GRACE_WARNING 12
46#define RBAC_PASSWORD_HAS_EXPIRED 100
47#define RBAC_ACCOUNT_LOCKED 101
48#define RBAC_CHANGE_AFTER_RESET 102
49#define RBAC_NO_MODIFICATIONS 103
50#define RBAC_MUST_SUPPLY_OLD 104
51#define RBAC_INSUFFICIENT_QUALITY 105
52#define RBAC_PASSWORD_TOO_SHORT 106
53#define RBAC_PASSWORD_TOO_YOUNG 107
54#define RBAC_HISTORY_VIOLATION 108
55#define RBAC_ACCOUNT_LOCKED_CONSTRAINTS 109
56
57#endif /* LDAP_RBAC_H */
58