semi合集-English.pdf - 第3361页

SEMI E132-0305 © SEMI 2004, 2005 14 Parameter Description Kind Form ACL Returned ACL of equipment. Nu ll list is returned if no ACL entries are defined. OUT Unordered list of types derived from ACLEntry, Section 11.2.4. …

100%1 / 7923
SEMI E132-0305 © SEMI 2004, 2005 13
12.3 Security Administration Interface
12.3.1 Figure 8 summarizes the standard services available through the security admin interface to any client
authenticated as the security admin. Equipment manufacturers are free to define additional operations if needed.
GetDefinedPrivileges()
GetACL()
AddACLEntry()
DeleteACLEntry()
GetActiveSessions()
SetMaxSessions()
GetMaxSessions()
«interface»
SecurityAdmin
Figure 8
Security Administration Interface
12.3.2 Security Administration Operations
Table 12 Security Administration Operations
Operation Description Type Requestor/
Sender
Responder/
Receiver
GetDefinedPrivileges Requests for the list of all privileges defined on equipment. RR Admin Equipment
GetACL Requests for the collection of ACL entries defined on the
equipment.
RR Admin Equipment
AddACLEntry Adds an ACL entry on the equipment. RR Admin Equipment
DeleteACLEntry Deletes an ACL entry on the equipment. RR Admin Equipment
GetActiveSessions Requests for information on all active sessions. RR Admin Equipment
SetMaxSessions Sets maximum limit on number of non-admin sessions
allowed.
RR Admin Equipment
GetMaxSessions Requests for the maximum limit of non-admin sessions
currently set on equipment.
RR Admin Equipment
12.3.2.1 GetDefinedPrivileges — This operation retrieves the set of privileges supported by the equipment
manufacturer. The list shall include the reserved “allPrivileges” Privilege defined in this specification (see Section
11.2.10).
Table 13 GetDefinedPrivileges Parameter Definitions
Parameter Description Kind Form
privileges Contains description and identifier of all defined privileges. OUT Unordered list of type
DefinedPrivilege, Section
12.3.3.3.
error Operation not authorized. error Structured data, of type
UnauthorizedOperationError,
Section 12.3.3.1.
error Unrecognized session. error Text, equal to unrecognized
session error, including the
bad session id.
12.3.2.2 GetACL — This operation requests for the entire ACL currently defined on the equipment.
Table 14 GetACL Parameter Definitions
Parameter Description Kind Form
SEMI E132-0305 © SEMI 2004, 2005 14
Parameter Description Kind Form
ACL Returned ACL of equipment. Null list is returned if no ACL
entries are defined.
OUT Unordered list of types
derived from ACLEntry,
Section 11.2.4.
error Unrecognized session. error Text, equal to unrecognized
session error, including the
bad session id.
error Operation not authorized. error Structured data, of type
UnauthorizedOperationError,
Section 12.3.3.1.
12.3.2.3 AddACLEntry — This operation adds a new ACL entry to the equipment’s ACL. If the ACLEntry is a
PrivilegeAssignment or a RoleAssignment for a Principal or Role that already has a PrivilegeAssignment or
RoleAssignment ACLEntry, the equipment shall return an error. If the ACLEntry is a PrivilegeAssignment and
refers to privilege id’s that are not supported by the equipment, the equipment shall return an error. If the ACLEntry
is a RoleAssignment and refers to a Role that does not have a PrivilegeAssignment ACLEntry defined, the
equipment shall return an error. If the ACLEntry is a RoleAssignment or PrivilegeAssignment that would result in
more than one Principal having the SecurityAdmin privilege (see Section 11.2.10.3), the equipment shall return an
error. Otherwise, the equipment shall store the newly-added ACLEntry together with the rest of the ACL in non-
volatile memory.
Table 15 AddACLEntry Parameter Definitions
Parameter Description Kind Form
aclEntry New ACL entry to be added. IN Structured data of type
ACLEntry, Section 11.2.4.
error Duplicate entry found. error Text equal to duplicate
principal/role name error.
error Unrecognized role. error Text equal to unrecognized
role error.
error Unrecognized privilege. error Structured data, of type
UnrecognizedPrivilegeError,
Section 12.3.3.3.
error Unrecognized session. error Text, equal to unrecognized
session error, including the
bad session id.
error Operation not authorized. error Structured data, of type
UnauthorizedOperationError,
Section 12.3.3.1.
12.3.2.4 DeleteACLEntry — This service removes an ACL entry from equipment’s ACL. The deletion of an
ACLEntry that has been applied to one or more active sessions does not affect the privileges granted to that session,
nor does it terminate any such session. Attempts to establish new sessions by a Principal whose
PrivilegeAssignment or RoleAssignment ACLEntry has been deleted shall be rejected by the equipment until a new
ACL entry is created for that Principal, or unless there is an ACLEntry for the reserved “anyPrincipal” (see Section
11.2.8). It is an error to delete a PrivilegeAssignment ACLEntry for a Role when there are still Principals assigned
to that Role through a RoleAssignment ACLEntry.
Table 16 DeleteACLEntry Parameter Definitions
Parameter Description Kind Form
subjectId Identifies the ACL entry to be deleted by the id of subject. IN Text
error Entry not found. error Text, equal to ACL entry not
found error.
error Unrecognized session. error Text, equal to unrecognized
session error, including the
SEMI E132-0305 © SEMI 2004, 2005 15
bad session id.
error Operation not authorized. error Structured data, of type
UnauthorizedOperationError,
Section 12.3.3.1.
12.3.2.5 GetActiveSessions — This operation allows the security admin to retrieve information for all active non-
admin sessions currently established on the equipment.
Table 17 GetActiveSessions Parameter Definitions
Parameter Description Kind Form
activeSessions List of active non-admin sessions on the equipment. An empty
list is returned if there are no active sessions.
OUT Unordered list, of type
ActiveSession, Section
12.3.3.4.
error Unrecognized session. error Text, equal to unrecognized
session error, including the
bad session id.
error Operation not authorized. error Structured data, of type
UnauthorizedOperationError,
Section 12.3.3.1.
12.3.2.6 SetMaxSessions — This operation allows the security admin to set the maximum number of simultaneous
non-admin sessions that the equipment will allow. This limit only applies to new session requests not coming from
the security admin, current established sessions are not affected. If the number of current active sessions exceeds
this limit, any new non-admin session requests shall be rejected by the equipment. New session requests are
authenticated first to determine if the client is not the security admin, then the check on the limit is made to
determine whether or not to reject the request. Setting this limit to 0 will restrict to security admin sessions only.
Table 18 SetMaxSessions Parameter Definitions
Parameter Description Kind Form
maxSessions Limit on number of simultaneous non-admin sessions equipment
will allow.
IN Integer.
sessionCount Total count of all current authenticated non-admin sessions on
equipment.
OUT Integer.
error Unrecognized session. error Text, equal to unrecognized
session error, including the
bad session id.
error Operation not authorized. error Structured data, of type
UnauthorizedOperationError,
Section 12.3.3.1.
12.3.2.7 GetMaxSessions — his operation retrieves the current maximum limit of simultaneous non-admin sessions
set on equipment.
Table 19 GetMaxSession Parameter Definitions
Parameter Description Kind Form
maxSessions Limit on number of simultaneous non-admin sessions equipment
will allow.
OUT Integer
sessionCount Total count of all current authenticated non-admin sessions on
equipment.
OUT Integer
error Unrecognized session. error Text, equal to unrecognized
session error, including the
bad session id.