Base Types#

Name	Description
`string`	Regular string
`uint8`	8 bit unsigned integer
`uint16`	16 bit unsigned integer
`uint32`	32 bit unsigned integer
`uint64`	64 bit unsigned integer
`int8`	8 bit signed integer
`int16`	16 bit signed integer
`int32`	32 bit signed integer
`int64`	64 bit signed integer
`leafref`	A reference to a configuration parameter somewhere else in the configuration tree. The leafref must point to an existing parameter.

Types#

Name	Base Type	Restrictions	Description
`alarm-text`	`string`		The string used to inform operators about the alarm. This MUST contain enough information for an operator to be able to understand the problem and how to resolve it. If this string contains structure, this format should be clearly documented for programs to be able to parse that information.
`alarm-type-id`			Identifies an alarm type. The description of the alarm type id MUST indicate whether or not the alarm type is abstract. An abstract alarm type is used as a base for other alarm type ids and will not be used as a value for an alarm or be present in the alarm inventory.
`alarm-type-qualifier`	`string`		If an alarm type cannot be fully specified at design time by ‘alarm-type-id’, this string qualifier is used in addition to fully define a unique alarm type. The definition of alarm qualifiers is considered to be part of the instrumentation and is out of scope for this module. An empty string is used when this is part of a key.
`allowed-asymmetric-key-management-algorithms`	`enumeration`	`RSA1_5` `RSA-OAEP` `RSA-OAEP-256` `ECDH-ES` `ECDH-ES+A128KW` `ECDH-ES+A192KW` `ECDH-ES+A256KW`	Algorithms supported to encrypt the content encryption key, present as ‘alg’ in JWE header
`allowed-content-encryption-algorithms`	`enumeration`	`A128CBC-HS256` `A192CBC-HS384` `A256CBC-HS512` `A128GCM` `A192GCM` `A256GCM`	Supported content encryption algorithms, present as ‘enc’ in JWE header
`allowed-key-management-algorithms`	`enumeration`	`RSA1_5` `RSA-OAEP` `RSA-OAEP-256` `ECDH-ES` `ECDH-ES+A128KW` `ECDH-ES+A192KW` `ECDH-ES+A256KW` `A128KW` `A192KW` `A256KW` `A128GCMKW` `A192GCMKW` `A256GCMKW`	Algorithms supported to encrypt the content encryption key, present as ‘alg’ in JWE header
`any-scope-including-none`	`string`	`0 to unbounded`	An empty string which can be helpful for defining ‘catch-all’ rules
`asymmetric-key-type`	`enumeration`	`rsa` `elliptic-curve` `dsa` `eddsa`
`attribute-location`	`enumeration`	`subject-attributes` `context-attributes` `action-attributes`	A location from where to retrieve or add attributes
`attribute-name`
`attribute-path`
`base64-encoded-string`	`string`	`1 to max`
`basic-claim-type`	`enumeration`	`any` `string` `number` `boolean` `object` `array`	Defines a basic type for claims values
`conf-timeout`	`uint8`	`1 to 20`	Valid configuration operation timeout in seconds
`culture`	`enumeration`	`sv-SE` `en-US` `en-GB`
`delegation-claim-name`	`enumeration`	`owner` `created` `expires` `scope` `claims` `clientId` `redirectUri` `status` `authorizationCodeHash` `authenticationAttributes` `requestedClaims` `mtlsClientCertificate` `mtlsClientCertificateThumbprintS256` `mtlsClientCertificateDN`
`disablable-token-time-to-live`			A type that defines token time-to-live values. If set to ‘disabled’, then the token type to’ which this setting refers will not be issued at all.
`eddsa-curve-name`	`enumeration`	`Ed25519` `Ed448`	Supported EdDSA curve names (curves taken from supported algorithms, see https://tools.ietf.org/html/rfc8037#section-3.1)
`elliptic-curve-name`	`enumeration`	`P-256` `P-384` `P-521`	Supported elliptic curve names (see https://tools.ietf.org/html/rfc7518#section-3.4)
`endpoint-types`	`enumeration`	`oauth-token` `oauth-authorize` `oauth-revoke` `oauth-introspect` `oauth-assisted-token` `oauth-anonymous` `oauth-userinfo` `oauth-dynamic-client-registration` `oauth-device-authorization` `oauth-session` `oauth-backchannel-authentication` `oauth-client-graphql-api` `oauth-granted-authorization-graphql-api` `oauth-verifiable-credential` `auth-authentication` `auth-registration` `auth-anonymous` `um-api` `um-graphql-api` `apps-anonymous` `saml-sso`
`jwt-algorithm`	`enumeration`	`RS256` `RS384` `RS512` `PS256` `PS384` `PS512` `HS256` `HS384` `HS512` `ES256` `ES384` `ES512` `EdDSA`	Available JWT signing algorithms (ref rfc7518, https://tools.ietf.org/html/rfc7518)
`non-empty-string`	`string`	`1 to max`
`operator-state`			Operator states on an alarm. The ‘closed’ state indicates that an operator considers the alarm being resolved. This is separate from the alarm’s ‘is-cleared’ leaf.
`profile-type`
`resource`			This is an identification of the alarming resource, such as an interface. It should be as fine-grained as possible to both guide the operator and guarantee uniqueness of the alarms. If the alarming resource is modeled in YANG, this type will be an instance-identifier. If the resource is an SNMP object, the type will be an ‘object-identifier’. If the resource is anything else, for example, a distinguished name or a Common Information Model (CIM) path, this type will be a string. If the alarming object is identified by a Universally Unique Identifier (UUID), use the uuid type. Be cautious when using this type, since a UUID is hard to use for an operator. If the server supports several models, the precedence should be in the order as given in the union definition.
`resource-match`			This type is used to match resources of type ‘resource’. Since the type ‘resource’ is a union of different types, the ‘resource-match’ type is also a union of corresponding types. If the type is given as an XPath 1.0 expression, a resource of type ‘instance-identifier’ matches if the instance is part of the node set that is the result of evaluating the XPath 1.0 expression. For example, the XPath 1.0 expression: /ietf-interfaces:interfaces/ietf-interfaces:interface [ietf-interfaces:type=‘ianaift:ethernetCsmacd’] would match the resource instance-identifier: /if:interfaces/if:interface[if:name=‘eth1’], assuming that the interface ‘eth1’ is of type ‘ianaift:ethernetCsmacd’. If the type is given as an object identifier, a resource of type ‘object-identifier’ matches if the match object identifier is a prefix of the resource’s object identifier. For example, the value: 1.3.6.1.2.1.2.2 would match the resource object identifier: 1.3.6.1.2.1.2.2.1.1.5 If the type is given as an UUID or a string, it is interpreted as an XML Schema regular expression, which matches a resource of type ‘yang:uuid’ or ‘string’ if the given regular expression matches the resource string. If the type is given as an XPath expression, it is evaluated in the following XPath context: o The set of namespace declarations is the set of prefix and namespace pairs for all YANG modules implemented by the server, where the prefix is the YANG module name and the namespace is as defined by the ‘namespace’ statement in the YANG module. If a leaf of this type is encoded in XML, all namespace declarations in scope on the leaf element are added to the set of namespace declarations. If a prefix found in the XML is already present in the set of namespace declarations, the namespace in the XML is used. o The set of variable bindings is empty. o The function library is the core function library, and the functions are defined in Section 10 of RFC 7950. o The context node is the root node in the data tree.
`scope`
`script`	`string`
`severity`	`enumeration`	`indeterminate` `warning` `minor` `major` `critical`	The severity level of the alarm. Note well that the value ‘clear’ is not included. Whether or not an alarm is cleared is a separate boolean flag.
`severity-with-clear`			The severity level of the alarm including clear. This is used only in notifications reporting state changes for an alarm.
`system-access-token-claim-name`	`enumeration`	`aud` `client_id` `delegationId` `exp` `iat` `iss` `nbf` `scope` `sub` `purpose` `cnf` `jti` `dcrm_client` `authorization_details`
`system-id-token-claim-name`	`enumeration`	`iss` `sub` `aud` `exp` `iat` `auth_time` `nonce` `acr` `amr` `azp` `nbf` `client_id` `delegationId` `purpose`
`system-user-info-endpoint-claim-name`	`enumeration`	`sub`
`system-wrapper-token-claim-name`	`enumeration`	`iss` `iat` `exp` `azp` `jti` `aud`
`token-credential-verifier-type`	`enumeration`	`static` `sql` `ldap`	A type for a credential-verifier
`token-issuer-type`	`enumeration`	`jwt` `opaque` `wrapped-opaque` `sd-jwt`	Defines the type of tokens this issuer produces (format)
`token-purpose-type`	`enumeration`	`access_token` `refresh_token` `id_token` `nonce` `generic` `userinfo` `verifiable_credential`
`token-time-to-live`	`uint32`	`10 to 4294967295`	A type that defines valid token time-to-live values
`writable-operator-state`	`enumeration`	`none` `ack` `closed`	Operator states on an alarm. The ‘closed’ state indicates that an operator considers the alarm being resolved. This is separate from the alarm’s ‘is-cleared’ leaf.

Identities#

Name	Base	Description
`al:alarm-type-id`	“	Base identity for alarm types. A unique identification of the alarm, not including the resource. Different resources can share alarm types. If the resource reports the same alarm type, it is considered to be the same alarm. The alarm type is a simplification of the different X.733 and 3GPP Alarm IRP correlation mechanisms, and it allows for hierarchical extensions. A string-based qualifier can be used in addition to the identity in order to have different alarm types based on information not known at design time, such as values in textual SNMP Notification varbinds. Standards and vendors can define sub-identities to clearly identify specific alarm types. This identity is abstract and MUST NOT be used for alarms.
`alde:deprecated-configuration`	`alde:system`	Usage of deprecated configuration
`alde:expiry`	`alde:system`	Expiry (i.e., expiration) of some resource has or will soon occur
`alde:external-service`	`al:alarm-type-id`	Alarms related to usages of external services
`alde:failed-authentication`	`alde:external-service`	Authentication failed when establishing a connection to the external service
`alde:failed-communication`	`alde:external-service`	A failure to communicate with an external service
`alde:failed-connection`	`alde:external-service`	A failure to connect to an external service
`alde:slow-connection`	`alde:external-service`	Communication with the external service is slower than acceptable
`alde:system`	`al:alarm-type-id`	Alarms related to the internals of Curity
`apps:apps-service`	`sc:profile-identity`	The Applications service identity
`as:authorization-actions.oauth`	`sc:authorization-actions`	All oauth-related actions that can be authorized by an authorization manager
`as:authorization-actions.oauth.user-read`	`as:authorization-actions.oauth`	The action that is used for all user read operations in the user info endpoint that an authorization manager may authorize
`as:oauth-service`	`sc:profile-identity`	The OAuth service identity
`auth:authentication-service`	`sc:profile-identity`	The Authentication service identity
`base:assisted-token-endpoint-identity`	`base:flow-identity`	This is the base identity for all assisted token endpoint flows
`base:authorize-endpoint-identity`	`base:flow-identity`	This is the base identity for all authorize endpoint flows
`base:backchannel-authentication-identity`	`base:flow-identity`	The is the base identity for backchannel authentication (CIBA) flow endpoints
`base:device-authorization-identity`	`base:flow-identity`	This is the base identity for device authorization flow endpoints
`base:flow-identity`	“	This is the base for all oauth flows
`base:introspect-endpoint-identity`	`base:flow-identity`	This is the base identity for all introspection endpoint flows
`base:oauth-assisted-token`	`base:assisted-token-endpoint-identity`	The Assisted token flow on the assisted token endpoint
`base:oauth-authorize-authorization-code`	`base:authorize-endpoint-identity`	The Authorization Code flow on the authorization endpoint
`base:oauth-authorize-implicit`	`base:authorize-endpoint-identity`	The Implicit flow on the authorization endpoint
`base:oauth-backchannel-authentication`	`base:backchannel-authentication-identity`	The backchannel authentication endpoint for initiating a CIBA flow
`base:oauth-device-authorization`	`base:device-authorization-identity`	The device code issuance flow of device verification
`base:oauth-introspect`	`base:introspect-endpoint-identity`	The introspect token flow on the introspection endpoint
`base:oauth-introspect-application-jwt`	`base:introspect-endpoint-identity`	The introspect token flow on the introspection endpoint (serving Content-Type ‘application/jwt’)
`base:oauth-token-assertion`	`base:token-endpoint-identity`	The Assertion grant type on the token endpoint
`base:oauth-token-authorization-code`	`base:token-endpoint-identity`	The Authorization Code flow grant type on the token endpoint
`base:oauth-token-backchannel-authentication`	`base:token-endpoint-identity`	The Backchannel Authentication (CIBA) grant type on the token endpoint
`base:oauth-token-client-credentials`	`base:token-endpoint-identity`	The Client Credentials grant type on the token endpoint
`base:oauth-token-device-code`	`base:token-endpoint-identity`	The Device Code grant type on the token endpoint
`base:oauth-token-oauth-token-exchange`	`base:token-endpoint-identity`	The OAuth 2.0 Token Exchange grant type on the token endpoint
`base:oauth-token-pre-authorized-code`	`base:token-endpoint-identity`	The Pre-Authorized Code flow grant type on the token endpoint
`base:oauth-token-refresh`	`base:token-endpoint-identity`	The Refresh token grant type on the token endpoint
`base:oauth-token-resource-owner-password-credentials`	`base:token-endpoint-identity`	The OAuth Resource Owner Password credentials grant type on the token endpoint
`base:oauth-token-token-exchange`	`base:token-endpoint-identity`	The Token Exchange grant type on the token endpoint
`base:openid-authorize-hybrid`	`base:authorize-endpoint-identity`	The Hybrid flow on the authorization endpoint
`base:openid-session-logout`	`base:session-endpoint-identity`	The Logout token flow on the session endpoint
`base:openid-userinfo`	`base:userinfo-endpoint-identity`	The UserInfo flow on the userinfo endpoint
`base:session-endpoint-identity`	`base:flow-identity`	This is the base identity for all the session endpoint flows
`base:token-endpoint-identity`	`base:flow-identity`	This is the base identity for all token endpoint flows
`base:userinfo-endpoint-identity`	`base:flow-identity`	This is the base identity for all userinfo endpoint flows
`base:verifiable-credential-endpoint-identity`	`base:flow-identity`	This is the base identity for all verifiable credential issuance endpoint flows
`base:verifiable-credential-issuance-jwt_vc_json`	`base:verifiable-credential-endpoint-identity`	Verifiable credential issuance using the ‘jwt_vc_json’ format
`base:verifiable-credential-issuance-vc_sd_jwt`	`base:verifiable-credential-endpoint-identity`	Verifiable credential issuance using the ‘vc+sd-jwt’ format
`sc:authorization-actions`	“	All actions that can be authorized by an authorization manager
`sc:profile-identity`	“	This is the base identity for all profiles
`si:saml-idp-service`	`sc:profile-identity`	The SAML IDP service
`um:authorization-actions.user-management`	`sc:authorization-actions`	All user-management-related actions that can be authorized by an authorization manager
`um:authorization-actions.user-management.admin`	`um:authorization-actions.user-management`	The actions that an admin may perform in the user management service that an authorization manager may authorize
`um:authorization-actions.user-management.admin.read`	`um:authorization-actions.user-management.admin`	The action that is used for all read-only operations in the user management service that an authorization manager may authorize
`um:authorization-actions.user-management.admin.write`	`um:authorization-actions.user-management.admin`	The action that is used for all write operations in the user management service that an authorization manager may authorize
`um:authorization-actions.user-management.delegations`	`um:authorization-actions.user-management`	The actions that may be performed in the delegations endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.delegations.admin`	`um:authorization-actions.user-management.delegations`	The actions that an admin may perform in the delegations endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.delegations.admin.read`	`um:authorization-actions.user-management.delegations.admin`	The actions that is used for all admin read operations in the delegations endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.delegations.admin.write`	`um:authorization-actions.user-management.delegations.admin`	The actions that is used for all admin write operations in the delegations endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.delegations.user`	`um:authorization-actions.user-management.delegations`	The action that is used for all read-only operations in the delegations endpoint service that an authorization manager may authorize
`um:authorization-actions.user-management.delegations.user.read`	`um:authorization-actions.user-management.delegations.user`	The actions that is used for all user read operations in the delegations endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.delegations.user.write`	`um:authorization-actions.user-management.delegations.user`	The actions that is used for all user write operations in the delegations endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.read`	`sc:authorization-actions`	The action that is used for read-only operations for any type of user
`um:authorization-actions.user-management.users`	`um:authorization-actions.user-management`	The actions that may be performed in the users endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.users.admin`	`um:authorization-actions.user-management.users`	The actions that an admin may perform in the users endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.users.admin.read`	`um:authorization-actions.user-management.users.admin`	The actions that is used for all admin read operations in the users endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.users.admin.write`	`um:authorization-actions.user-management.users.admin`	The actions that is used for all admin write operations in the users endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.users.user`	`um:authorization-actions.user-management.users`	The action that is used for all read-only operations in the users endpoint service that an authorization manager may authorize
`um:authorization-actions.user-management.users.user.read`	`um:authorization-actions.user-management.users.user`	The actions that is used for all user read operations in the users endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.users.user.write`	`um:authorization-actions.user-management.users.user`	The actions that is used for all user write operations in the users endpoint that an authorization manager may authorize
`um:authorization-actions.user-management.write`	`sc:authorization-actions`	The action that is used for write-only operations for any type of user
`um:user-management-service`	`sc:profile-identity`	The User Management service identity

Administration

System and Operation

Facilities

Profiles

Developer Guide

Configuration Reference

Base Types#

Types#

Identities#