objectidentifier keystoneSchema 1.3.6.1.3.1.666.667
objectidentifier keystoneAttrs keystoneSchema:3
objectidentifier keystoneOCs keystoneSchema:4

attributetype (
    keystoneAttrs:1
    NAME 'keystoneEnabled'
    EQUALITY booleanMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
    SINGLE-VALUE
    )

attributetype (
    keystoneAttrs:2
    NAME 'keystoneTenant'
    SUP distinguishedName
    SINGLE-VALUE
    )

attributetype (
    keystoneAttrs:3
    NAME 'keystoneRole'
    SUP distinguishedName
    SINGLE-VALUE
    )

attributetype (
    keystoneAttrs:4
    NAME 'serviceId'
    EQUALITY caseExactIA5Match
    SUBSTR caseExactIA5SubstringsMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
    SINGLE-VALUE
    )
attributetype: (
    keystoneAttrs:5
    NAME 'keystoneName'
    SUP name
    SINGLE-VALUE
    )
objectClass (
    keystoneOCs:1
    NAME 'keystoneUidObject'
    SUP top
    STRUCTURAL
    MUST ( uid )
    )

objectClass (
    keystoneOCs:2
    NAME 'keystoneUser'
    SUP top
    AUXILIARY
    MUST ( keystoneName )
    MUST ( keystoneEnabled )
    MAY ( mail $ userPassword )
    )

objectClass (
    keystoneOCs:3
    NAME 'keystoneRole'
    SUP top
    AUXILIARY
    MUST ( cn )
    MAY ( member $ description $ serviceId )
    )

objectClass (
    keystoneOCs:4
    NAME 'keystoneTenant'
    SUP top
    AUXILIARY
    MUST ( keystoneName )
    MUST ( keystoneEnabled )
    MAY ( member $ description )
    )

objectClass (
    keystoneOCs:5
    NAME 'keystoneTenantRole'
    SUP top
    AUXILIARY
    MUST ( keystoneRole )
    MAY ( member )
    )
