// ===================================================================
// Title:       User-Security Accounts 2.7
// Filename:    User27_Account.mof
// Version:     2.7.0
// Status:      Preliminary
// Date:        07/07/2002
// ===================================================================
// Copyright 2000-2002 Distributed Management Task Force, Inc. (DMTF).
// All rights reserved.  
// DMTF is a not-for-profit association of industry members dedicated 
// to promoting enterprise and systems management and interoperability. 
// DMTF specifications and documents may be reproduced for uses
// consistent with this purpose by members and non-members, 
// provided that correct attribution is given. 
// As DMTF specifications may be revised from time to time, 
// the particular version and release date should always be noted.
//
// Implementation of certain elements of this standard or proposed 
// standard may be subject to third party patent rights, including 
// provisional patent rights (herein "patent rights"). DMTF makes 
// no representations to users of the standard as to the existence 
// of such rights, and is not responsible to recognize, disclose, or
// identify any or all such third party patent right, owners or 
// claimants, nor for any incomplete or inaccurate identification or 
// disclosure of such rights, owners or claimants. DMTF shall have no 
// liability to any party, in any manner or circumstance, under any 
// legal theory whatsoever, for failure to recognize, disclose, or 
// identify any such third party patent rights, or for such party's
// reliance on the standard or incorporation thereof in its product, 
// protocols or testing procedures. DMTF shall have no liability to 
// any party implementing such standard, whether such implementation 
// is foreseeable or not, nor to any patent owner or claimant, and shall 
// have no liability or responsibility for costs or losses incurred if 
// a standard is withdrawn or modified after publication, and shall be
// indemnified and held harmless by any party implementing the 
// standard from any and all claims of infringement by a patent owner 
// for such implementations.
//
// For information about patents held by third-parties which have 
// notified the DMTF that, in their opinion, such patent may relate to 
// or impact implementations of DMTF standards, visit 
// http://www.dmtf.org/about/policies/disclosures.php.
// ===================================================================
// Description: The User Model extends the management concepts that
//              are related to users and security.
//              This file defines the concepts and classes related to  
//              Accounts.
//
//              The object classes below are listed in an order that
//              avoids forward references. Required objects, defined 
//              by other working groups, are omitted.
// ===================================================================
// Change Log for v2.7 - None
// ===================================================================

#pragma Locale ("en_US")


// ================================================================== 
// Account
// ==================================================================
[Version ("2.6.0"), Description (
   "CIM_Account is the information held by a SecurityService "
   "to track identity and privileges managed by that service.  "
   "Common examples of an Account are the entries in a UNIX "
   "/etc/passwd file.  Several kinds of security services use "
   "various information from those entries - the /bin/login "
   "program uses the account name ('root') and hashed password "
   "to authenticate users, and the file service, for instance, "
   "uses the UserID field ('0') and GroupID field ('0') to "
   "record ownership and determine access control privileges "
   "on files in the file system. This class is defined so as "
   "to incorporate commonly-used LDAP attributes to permit "
   "implementations to easily derive this information from "
   "LDAP-accessible directories.") ]
class CIM_Account : CIM_LogicalElement {

   [Propagated ("CIM_System.CreationClassName"), Key, 
      MaxLen (256), Description ("The scoping System's CCN.") ]
   string SystemCreationClassName;

   [Propagated ("CIM_System.Name"), Key, 
      MaxLen (256),Description ("The scoping System's Name.") ]
   string SystemName;

   [Key, MaxLen (256), Description (  
      "CreationClassName indicates the name of the class or the "
      "subclass used in the creation of an instance. When used "
      "with the other key properties of this class, this property "
      "allows all instances of this class and its subclasses to "
      "be uniquely identified.") ]
   string CreationClassName;

   [Key, Override("Name"), MaxLen (1024), Description (  
      "The Name property defines the label by which the object is "
      "known.  The value of this property may be set to be the same "
      "as that of the UserID property or, in the case of an "
      "LDAP-derived instance, the Name property value may be set to "
      "the distinguishedName of the LDAP-accessed object instance.") ]
   string Name;

   [MaxLen (256), Description (
      "UserID is the value used by the SecurityService to "
      "represent identity.  For an authentication service, the "
      "UserID may be the name of the user, or for an authorization "
      "service the value which serves as a handle to a mapping of "
      "the identity.") ] 
   string UserID;

   [Description (  
      "In the case of an LDAP-derived instance, the ObjectClass "
      "property value(s) may be set to the objectClass attribute "
      "values.") ]
   string ObjectClass[];

   [MaxLen (1024), Description (  
      "The Descriptions property values may contain human-readable "
      "descriptions of the object.  In the case of an LDAP-derived "  
      "instance, the description attribute may have multiple values "
      "that, therefore, cannot be placed in the inherited "
      "Description property.") ]
   string Descriptions[];

   [Description (
      "Based on RFC1274, the host name of the system(s) for which "
      "the account applies.  The host name may be a fully-qualified "
      "DNS name or it may be an unqualified host name.") ] 
   string Host[];

   [Description (  
      "This property contains the name of a locality, such as a "
      "city, county or other geographic region.") ]
   string LocalityName[];

   [Required, Description (  
      "The name of the organization related to the account.") ]
   string OrganizationName[];

   [Description (  
      "The name of an organizational unit related to the account.") ]
   string OU[];

   [Description (  
      "In the case of an LDAP-derived instance, the See Also "
      "property specifies distinguishedName of other Directory "
      "objects which may be other aspects (in some sense) of the "
      "same real world object.") ]
   string SeeAlso[];

   [Octetstring, Description (
      "Based on inetOrgPerson and for directory compatibility, the "
      "User Certificate property may be used to specify a public key "
      "certificate for the person.") ]
   string UserCertificate[];

   [Octetstring, Description (  
      "In the case of an LDAP-derived instance, the UserPassword "
      "property may contain an encrypted password used to access "
      "the person's resources in a directory.") ]
   string UserPassword[];
};


// ===================================================================
// AccountOnSystem
// ===================================================================
[Association, Aggregation, Version ("2.6.0"), Description (
   "A system (e.g., ApplicationSystem, ComputerSystem, AdminDomain) "
   "aggregates Accounts and scopes the uniqueness of the Account "
   "names (i.e., userids).") ]
class CIM_AccountOnSystem : CIM_SystemComponent {

   [Override ("GroupComponent"), Min (1), Max (1), Aggregate, 
      Description (
      "The aggregating system also provides name scoping "
      "for the Account.") ]
   CIM_System REF GroupComponent;

   [Override ("PartComponent"), Weak,
      Description ("The subordinate Account.") ]
   CIM_Account REF PartComponent;
};


// ===================================================================
// UsersAccount
// ===================================================================
[Association, Version ("2.6.0"), Description (
   "This relationship associates UsersAccess with the Accounts "
   "with which they're able to interact.") ]
class CIM_UsersAccount : CIM_Dependency {

   [Override ("Antecedent"), 
      Description ("The user's Account.") ]
   CIM_Account REF Antecedent;

   [Override ("Dependent"), Description (
      "The User as identified by their UsersAccess instance.") ]
   CIM_UsersAccess REF Dependent;
};


// ===================================================================
// AccountMapsToAccount
// ===================================================================
[Association, Version ("2.6.0"), Description (
   "This relationship may be used to associate an Account used by an "
   "AuthenticationService to an Account used for Authorization.  For "
   "instance, this mapping occurs naturally in the UNIX /etc/passwd "
   "file, where the AuthenticationSerice Account ('root') is mapped "
   "to the AuthorizationService Account ('0').  The two are separate "
   "accounts, as evidenced by the ability to have another "
   "AuthenticationService Account which ALSO maps to the "
   "AuthorizationService Account ('0') without ambiguity.  This "
   "association may be used for other account mappings as well such "
   "as for coordinating single signon for multiple accounts for the "
   "same user.") ]
class CIM_AccountMapsToAccount : CIM_Dependency {

   [Override ("Antecedent"), 
      Description ("An Account.") ]
   CIM_Account REF Antecedent;

   [Override ("Dependent"),
      Description ("A related Account.") ]
   CIM_Account REF Dependent;
};


// ===================================================================
// SecurityServiceUsesAccount
// ===================================================================
[Association, Version ("2.6.0"), Description (
   "This relationship associates SecurityService instances to "
   "the Accounts they use in the course of their work.") ]
class CIM_SecurityServiceUsesAccount : CIM_Dependency {

   [Override ("Antecedent") ]
   CIM_Account REF Antecedent;

   [Override ("Dependent") ]
   CIM_SecurityService REF Dependent;
};


// ================================================================== 
// AccountManagementService
// ==================================================================
[Version ("2.6.0"), Description (
   "CIM_AccountManagementService creates, manages, and if necessary "
   "destroys Accounts on behalf of other SecuritySerices.") ]
class CIM_AccountManagementService : CIM_SecurityService {
};


// ===================================================================
// ManagesAccount
// ===================================================================
[Association, Version ("2.6.0"), Description (
   "This relationship associates the AccountManagement security "
   "service to the Accounts for which it is responsible.") ]
class CIM_ManagesAccount : CIM_Dependency {

   [Override ("Antecedent") ]
   CIM_AccountManagementService REF Antecedent;

   [Override ("Dependent") ]
   CIM_Account REF Dependent;
};


// ===================================================================
// ManagesAccountOnSystem
// ===================================================================
[Association, Version ("2.6.0"), Description (
   "The CIM_ManagesAccountOnSystem provides the association between a "
   "System and the AccountManagementService that manages accounts for "
   "that system.") ]
class CIM_ManagesAccountOnSystem : CIM_SecurityServiceForSystem {

   [Override ("Antecedent"), Description ( 
      "An AccountManagementService that manages accounts for the "
      "system.") ]
   CIM_AccountManagementService REF Antecedent;

   [Override ("Dependent"), Description (
      "The system that is dependent on the AccountManagementService.") ]
   CIM_System REF Dependent;
};


// ===================================================================
// end of file
// ===================================================================