Status Set Extension Mapping for the Extensible Provisioning Protocol

Introduction This document describes an Extensible Provisioning Protocol (EPP) extension for the provisioning and management of status sets applied to EPP objects, such as the domain name object in and the host object in . The EPP status values defined in the EPP object mappings, such as Section 2.3 of , support human-readable text that describes the rationale or reason for the status applied to the object. There can be many overlapping reasons for a status value being applied to the object, such as implementing a lock service, complying with a court order, or addressing domain abuse. A status set defines an object representing the reason for setting a list of status values, so clients and servers can manage the status sets in place of individual status values to effectively manage the overlapping reasons. The EPP extension supports the provisioning of client status sets, disclosure of the server status sets, and an enhanced authorization model for client status sets with the Authentication Token in draft-gould-regext-epp-auth-token. This document defines new EPP commands in the form of the Status Set Info, Status Set Create, Status Set Delete, Status Set Renew, and Status Set Update. This document describes a Status Set Extension Mapping for version 1.0 of the Extensible Provisioning Protocol (EPP) . This extension is specified using the XML 1.0 as described in and XML Schema notation as described in and .

Conventions Used in This Document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in when, and only when, they appear in all capitals, as shown here. In examples, "C:" represents lines sent by a protocol client and "S:" represents lines returned by a protocol server. Indentation and white space in examples is provided only to illustrate element relationships and is not a REQUIRED feature of this specification. XML is case sensitive. Unless stated otherwise, XML specifications and examples provided in this document MUST be interpreted in the character case presented to develop a conforming implementation. The XML namespace prefix "statusSet" is used for the namespace "urn:ietf:params:xml:ns:epp:statusSet-0.1", but implementations MUST NOT depend on it; instead, they should employ a proper namespace-aware XML parser and serializer to interpret and output the XML documents.

Registrar User defines the registrar as "a service provider that acts as a go-between for registrants and registries." and defines the registrant and registry. A registrar can have many users that interface with the registry across many channels, such as EPP and Web User Interface (UI), which is referred to as a Registrar User in this document. The EPP client in , referred to as the EPP Registrar User is this document, is a registrar system that uses the EPP Registrar User credentials to authenticate with the <login> command to establish an EPP session. The Registrar User authenticates to create the Authentication Token, defined in draft-gould-regext-epp-auth-token, that MUST NOT be the EPP Registrar User since the EPP Registrar User is used only to create the EPP session. The ability to provision Status Sets using an Authentication Token is based on enabling a Registrar User to generate an Authentication Token and having the required set of authorization groups to authorize a Status Set action.

Object Attributes This extension adds additional elements to EPP objects, such as the domain name mapping described in and the host mapping described in . Common attributes are described here.

Status Value A Status Value is defined for EPP objects in the EPP extensions, such as Status Values in Section 2.3 of and Section 3.1 of . There is a single Status Value assigned to an object by type, such as the "clientUpdateProhibited" Status Value in and the "redemptionPeriod" Status Value in . The Status Value can include a text message indicating the reason(s) that the Status Value is set, such as: Auth Token Lock,Registrar Lock ]]> Inclusion and format of the Status Value reason(s) is specific to each server implemenation, and the client needs to implement the server-specific format. The Status Set, described in , makes the reason string into a named object with a set of attributes, including the associated Status Values.

Status Set A Status Set is an object that defines the reason for the Status Values for an EPP object, such as the domain name object in and the host object in . The Status Set can also be used as a Marker Status Set when there are no mapped Status Values that can drive additional business logic and publishing use cases. An EPP object can have many assigned Status Sets, and the Status Sets can include an overlapping set of Status Values. The Status Value will be assigned to the object if there is at least one Status Set assigned to the object with the mapped Status Value. The Status Value will be unassigned from the object when all Status Sets are unassigned with the mapped Status Value. For example, both the "Registrar Lock" Status Set and the "Auth Token Lock" Status Set are mapped to the "clientUpdateProhibited" Status Value, where if either of the Status Sets are assigned to the EPP object, the "clientUpdateProhibited" Status Value will be assigned. "clientUpdateProhibited" Status Value will be unassigned if both "Registrar Lock" Status Set and "Auth Token Lock" Status Sets are unassigned. A Status Set has the following attributes:

"name": The unique name for the Status Set that is up to server policy. The reserved name "REDACTED" can be used for a Server Status Set where the server cannot disclose the reason, such as the case for a sealed court order. Example names include "Registrar Lock", "Auth Token Lock", and "Registry Lock".
"type": The type of Status Set, which is either "client" for a Client Status Set or "server" for a Server Status Set. A Client Status Set MAY be set, unset, and overridden with authorization defined in the Authentication Token by the client. A Server Status Set MUST only be set and unset by the server and MUST NOT be overridden by the client.
"authTokenUsed": A boolean value indicating whether or not an Authentication Token is used with the Client Status Set. If "true", an Authentication Token is needed to authorize setting, unsetting, and overriding the Client Status Set; otherwise the Authentication Token does not need to be passed. This value MUST be set only when the "type" attribute is set to "client".
"inherited": A boolean value indicating whether or not the Status Set is inherited from the parent object (domain name) and is inherited by the child objects (hosts). The Status Values of the object only include Status Sets directly assigned and not inherited by the object. Inherited Status Values are enforced by the server but NOT persisted to the child object.
"assigned": A boolean value indicating whether or not the Status Set is directly assigned to the object. The <info> command supports returning "all" Status Sets for the client to see what Client Status Sets are available and directly assigned to the object. Only "assigned" Server Status Sets will be returned in the <info> response extension.
"crDate": Date and time that the Status Set was assigned to the EPP object.
"status": List of 0 or more Status Values mapped to the Status Set. A Status Set with zero Status Values is considered a Marker Status Set. Example Status Values include the lock statuses from and with "clientUpdateProhibited", "clientDeleteProhibited", "clientTransferProhibited", "serverUpdateProhibited", "serverDeleteProhibited", and "serverTransferProhibited".
"reason": Reason that the Status Set was assigned to the object. This is only needed when the "name" attribute alone doesn't clearly indicate the reason. An example is providing the more detailed reason "Botnet domain name" for the "Domain Abuse" Status Set.

A client can manage Client Status Values using Client Status Sets instead of setting individual Client Status Values, since the Status Set represents a container of Status Values that can overlap. The Status Set provides an explicit signal of the Status Value reasons that improves the status management when there are overlapping reasons. The support for the Authentication Token provides an additional layer of authorization with the ability to override Client Status Sets in Status Set transform commands.

Authentication Token The Authentication Token, defined in section 2.1 of draft-gould-regext-epp-auth-token, uses JSON Web Signature (JWS), defined in , with JWS Compact Serialization, defined in Section 3.1 of , to digitally sign the JWS Protected Header properties and JWS Payload claims in a single string that is embedded in the <statusSet:authToken> XML element. An Authentication Token is used to authorize provisioning and overriding a Client Status Set that has the <statusSet:authTokenUsed> element set to "1" or "true" in the Status Set Info Response. The overriding capability MUST only apply to Client Status Sets. Example Authentication Token XML element: eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z 5PFZeR5k-ScmDEDdFl9nIFCLd5-mF ]]>

M-of-N M-of-N applies to the use of Authentication Tokens, where M defines the number of registrar users with a valid Authentication Token needed to authorize a Status Set action out of N registrar users that can generate an Authentication Token. The Status Set transform commands support providing a list of Authentication Tokens, using the <statusSet:authToken> elements. The value of M is up to server policy and can be at the server-level that applies to all registrars or can apply at the registrar-level and configured on a per-registrar basis. The value of N is dynamic and is based on the number of registrar users that support the generation of Authentication Tokens in the server.

EPP Command Mapping A detailed description of the EPP syntax and semantics can be found in the EPP core protocol specification .

EPP Query Commands This document defines one EPP Query Command with <info> to retrieve the Status Set information for the object. This document does not define a mapping for the EPP <check> command or the <transfer> command.

EPP <check> Command This extension does not add any elements to the EPP <check> command or <check> response.

EPP <info> Command A new Status Set Info Command by extending the EPP <info> command to get information for an EPP object with the inclusion of the Status Set information, defined in , that is optionally authorized by applying the Authentication Tokens and their authorization groups, defined in . In addition to the EPP command elements described in the EPP <info> command, the command MAY contain an <extension> element. The <extension> element MUST contain a child <statusSet:info> element with an OPTIONAL "sets" attribute that can be either "assigned" or "all", with "assigned" being the default value. The value "assigned" can be used to return the Status Sets directly assigned to or inherited by the EPP object, and "all" to return the Status Sets that are assigned to and available for the EPP object. The <statusSet:info> element contains the following child elements:

An OPTIONAL list of <statusSet:authToken> elements, defined in , that supports authorizing the data returned in the Status Set Info Response in support of M-of-N authorization, defined in . The authorization groups in the list of Authentication Tokens are intersected to determine the data that will be returned. If no <statusSet:authToken> elements are provided, the server will return the default data based on the EPP Registrar User authorization of the EPP session.

Example Domain Name Status Set Info Command that uses the default "assigned" form: C: C: C: C: C: domain.example C: C: C: C: C: C: ABC-12345 C: C: ]]> Example Domain Name Status Set Info Command that uses the "assigned" form with two authentication tokens to determine the data returned: C: C: C: C: C: domain.example C: C: C: C: C: C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF C: C: C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk C: C: C: C: ABC-12345 C: C: ]]> Example Domain Name Status Set Info Command that uses the "all" form: C: C: C: C: C: domain.example C: C: C: C: C: C: ABC-12345 C: C: ]]> If the query was successful, the server replies with a <statusSet:infData> element along with the regular EPP <resData>. The <statusSet:infData> contains the following child elements:

A <statusSet:name> element that includes the unique name for the Status Set that is up to server policy. Example names include "Registrar Lock", "Auth Token Lock", and "Registry Lock". There is a reserved value of "REDACTED" that is used for a Server Status Set, where the name must be redacted based on server policy.
A <statusSet:type> element that indicates whether the Status Set is a Client Status Set with a value of "client" or the Status Set is a Server Status Set with a value of "server".
An OPTIONAL <statusSet:authTokenUsed> element that is a boolean with a default value of "false" that indicates whether the Status Set uses the Authentication Token, defined in . If "1" or "true", an Authentication Token is needed to authorize the setting, unsetting, and overriding the Client Status Set; otherwise with a value of "0" or "false" the Authentication Token does not need to be passed. An OPTIONAL "num" attribute, with a default value of "1", indicates the M value in M-of-N, defined in .
An OPTIONAL <statusSet:inherited> element that is a boolean with a default value of "false" that indicates whether the Status Set is inherited from the parent object (domain name), in the case of the EPP Host object in , and is inherited by the child objects (hosts), in the case of the EPP Domain Name object in .
An OPTIONAL <statusSet:assigned> element that is a boolean with a default value of "true" that indicates whether the Status Set is assigned to the EPP object. A value of "false" indicates that the Status Set is available to be set, which only applies to Client Status Sets.
An OPTIONAL <statusSet:crDate> element that is the date and time that the Status Set was assigned to the object.
An OPTIONAL list of zero or more <statusSet:status> elements that includes the Status Values, defined in mapped to the Status Set.
An OPTIONAL <statusSet:reason> element that indicates the freefrom text reason that Status Set was assigned to the object.

Example Domain Name Status Set Info Response that includes the assigned Client Status Sets ("Auth Token Lock" and "Registrar Lock") and the assigned Server Status Set ("Registry Lock"): S: S: S: S: Command completed successfully S: S: S: S: example.com S: EXAMPLE1-REP S: S: Auth Token Lock,Registrar Lock S: S: S: Auth Token Lock,Registrar Lock S: S: S: Auth Token Lock,Registrar Lock S: S: S: Registry Lock S: S: S: Registry Lock S: S: S: Registry Lock S: S: S: ns1.example.com S: ns1.example.net S: S: ns1.example.com S: ns2.example.com S: ClientX S: ClientY S: 2000-04-03T22:00:00.0Z S: ClientX S: 2026-05-03T09:10:00.0Z S: 2027-04-03T22:00:00.0Z S: 2022-04-08T09:00:00.0Z S: S: 2fooBAR S: S: S: S: S: S: S: Auth Token Lock S: client S: true S: true S: true S: 2026-05-03T09:00:00.0Z S: S: clientUpdateProhibited S: S: clientDeleteProhibited S: S: clientTransferProhibited S: S: S: S: Registrar Lock S: client S: false S: false S: true S: 2026-05-03T09:00:00.0Z S: S: clientUpdateProhibited S: S: clientDeleteProhibited S: S: clientTransferProhibited S: S: S: S: Registry Lock S: server S: false S: false S: true S: 2026-05-03T09:10:00.0Z S: S: serverUpdateProhibited S: S: serverDeleteProhibited S: S: serverTransferProhibited S: S: S: S: S: S: ABC-12345 S: 54322-XYZ S: S: S: ]]> Example Domain Name Status Set Info Response with the "all" form that includes the two assigned Client Status Sets ("Registrar Lock", "Auth Token Lock"), the two assigned Server Status Sets ("Registry Lock" and the reserved "REDACTED"), and the available Client Status Set ("Registrar Court Order Lock"): S: S: S: S: Command completed successfully S: S: S: S: example.com S: EXAMPLE1-REP S: S: Auth Token Lock,Registrar Lock S: S: S: Auth Token Lock,Registrar Lock S: S: S: Auth Token Lock,Registrar Lock S: S: S: Registry Lock S: S: S: Registry Lock S: S: S: Registry Lock S: S: S: REDACTED S: S: S: ns1.example.com S: ns1.example.net S: S: ns1.example.com S: ns2.example.com S: ClientX S: ClientY S: 2000-04-03T22:00:00.0Z S: ClientX S: 2026-05-03T09:10:00.0Z S: 2027-04-03T22:00:00.0Z S: 2022-04-08T09:00:00.0Z S: S: 2fooBAR S: S: S: S: S: S: S: Auth Token Lock S: client S: true S: true S: true S: 2026-05-03T09:00:00.0Z< S: /statusSet:crDate> S: clientUpdateProhibited S: S: clientDeleteProhibited S: S: clientTransferProhibited S: S: S: S: Registrar Lock S: client S: false S: false S: true S: 2026-05-03T09:00:00.0Z S: S: clientUpdateProhibited S: S: clientDeleteProhibited S: S: clientTransferProhibited S: S: S: S: Registry Lock S: server S: false S: false S: true S: 2026-05-03T09:10:00.0Z S: S: serverUpdateProhibited S: S: serverDeleteProhibited S: S: serverTransferProhibited S: S: S: S: REDACTED S: server S: false S: false S: true S: 2026-05-01T10:11:00.0Z S: S: serverHold S: S: S: Registrar Court Order Lock S: S: client S: false S: false S: false S: clientUpdateProhibited S: S: clientDeleteProhibited S: S: clientTransferProhibited S: S: S: S: S: S: ABC-12345 S: 54322-XYZ S: S: S: ]]> Example Host Status Set Info Response that includes an the inherited Client Status Set ("Auth Token Lock") from the parent domain name: S: S: S: S: Command completed successfully S: S: S: S: ns1.example.com S: NS1_EXAMPLE1-REP S: S: 192.0.2.2 S: 192.0.2.29 S: 1080:0:0:0:8:800:200C:417A S: ClientY S: ClientX S: 2000-04-03T22:00:00.0Z S: ClientX S: 2026-05-03T09:00:00.0Z S: 2022-04-08T09:00:00.0Z S: S: S: S: S: S: Auth Token Lock S: client S: true S: true S: false S: 2026-05-03T09:00:00.0Z S: S: clientUpdateProhibited S: S: clientDeleteProhibited S: S: clientTransferProhibited S: S: S: S: S: S: ABC-12345 S: 54322-XYZ S: S: S: ]]>

EPP <transfer> Command This extension does not add any elements to the EPP <transfer> query command or <transfer> query response.

EPP Transform Commands This document defines a new EPP Status Set Command for each of the EPP Transform Commands, defined in , to enable the provisioning of the Client Status Sets in the <create> and <update> commands and the overriding of the Client Status Sets with the passing of one or more Authentication Tokens in each of the EPP Status Set Transform Commands. An example is the definition of the EPP Domain Status Set Update Command in extending the domain name <update> command in .

EPP <create> Command A new Status Set Create Command by extending the EPP <create> command to create an EPP object, such as the domain name in or a host in , with a list of Status Sets that will be assigned initially. In addition to the EPP command elements described in the EPP <create> command, the command MAY contain an <extension> element. The <extension> element MUST contain a child <statusSet:create> element that contains the following child elements:

An OPTIONAL list of <statusSet:authToken> elements, defined in , that supports authorizing the assigning of the Status Sets in support of M-of-N authorization, defined in .
One or more <statusSet:statusSet> elements that include the unique name of the Status Set, defined in .

Example Domain Name Status Set Create Command that sets the "Registrar Lock" Status Set: C: C: C: C: C: example.com C: 2 C: C: ns1.example.net C: ns2.example.net C: C: C: 2fooBAR C: C: C: C: C: C: Registrar Lock C: C: C: ABC-12345 C: C: ]]> Example Domain Name Status Set Create Command that sets the "Registrar Lock" Status Set and the "Auth Token Lock", which includes 2 Authentication Tokens to meet an M value of 2, in M-of-N: C: C: C: C: C: example.com C: 2 C: C: ns1.example.net C: ns2.example.net C: C: C: 2fooBAR C: C: C: C: C: C: C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF C: C: C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk C: C: Registrar Lock C: Auth Token Lock C: C: C: ABC-12345 C: C: ]]> This extension does not define any extension to the response of a <create> command. After processing the command, the server replies with a standard EPP response as defined in the EPP object mapping, such as defined in Section 3.2.1 of .

EPP <delete> Command A new Status Set Delete Command by extending the EPP <delete> command to delete an EPP object that is authorized by applying the Authentication Tokens and their authorization groups, defined in , to override the assigned Client Status Sets that uses Authentication Tokens. In addition to the EPP command elements described in the EPP <delete> command, the command MAY contain an <extension> element. The <extension> element MUST contain a child <statusSet:delete> element that contains the following child elements:

One or more <statusSet:authToken> elements, defined in , that authorizes the overriding of the Client Status Sets in support of M-of-N authorization, defined in .

Example Domain Name Status Set Delete Command that includes a single Authentication Token (M = 1 with M-of-N authorization) to authorize the delete: C: C: C: C: C: example.com C: C: C: C: C: C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF C: C: C: C: ABC-12345 C: C: ]]> This extension does not define any extension to the response of an <delete> command. After processing the command, the server replies with a standard EPP response as defined in the EPP object mapping, such as defined in Section 3.2.2 of .

EPP <renew> Command A new Status Set Renew Command by extending the EPP <renew> command to renew an EPP object that is authorized by applying the Authentication Tokens and their authorization groups, defined in , to override the assigned Client Status Sets that uses Authentication Tokens. In addition to the EPP command elements described in the EPP <renew> command, the command MAY contain an <extension> element. The <extension> element MUST contain a child <statusSet:renew> element that contains the following child elements:

One or more <statusSet:authToken> elements, defined in , that authorizes the overriding of the Client Status Sets in support of M-of-N authorization, defined in .

Example Domain Name Status Set Renew Command that includes a single Authentication Token (M = 1 with M-of-N authorization) to authorize the renew: C: C: C: C: C: example.com C: 2026-04-03 C: 5 C: C: C: C: C: C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF C: C: C: C: ABC-12345 C: C: ]]> This extension does not define any extension to the response of an <renew> command. After processing the command, the server replies with a standard EPP response as defined in the EPP object mapping, such as defined in Section 3.2.3 of .

EPP <transfer> Command A new Status Set Transfer Command by extending the EPP <transfer> command to transfer an EPP object that is authorized by applying the Authentication Tokens and their authorization groups, defined in , to override the assigned Client Status Sets that uses Authentication Tokens. In addition to the EPP command elements described in the EPP <transfer> command, the command MAY contain an <extension> element. The <extension> element MUST contain a child <statusSet:transfer> element that contains the following child elements:

One or more <statusSet:authToken> elements, defined in , that authorizes the overriding of the Client Status Sets in support of M-of-N authorization, defined in .

Example Domain Name Status Set Transfer Command that includes a single Authentication Token (M = 1 with M-of-N authorization) to authorize the transfer: C: C: C: C: C: example.com C: 1 C: C: 2fooBAR C: C: C: C: C: C: C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF C: C: C: C: ABC-12345 C: C: ]]> This extension does not define any extension to the response of an <transfer> command. After processing the command, the server replies with a standard EPP response as defined in the EPP object mapping, such as defined in Section 3.2.4 of .

EPP <update> Command A new Status Set Update Command by extending the EPP <update> command to transfer an EPP object that is authorized by applying the Authentication Tokens and their authorization groups, defined in , to override the assigned Client Status Sets that uses Authentication Tokens. In addition to the EPP command elements described in the EPP <update> command, the command MAY contain an <extension> element. The <extension> element MUST contain a child <statusSet:update> element that contains the following child elements:

An OPTIONAL list of <statusSet:authToken> elements, defined in , that authorizes the overriding of the Client Status Sets in support of M-of-N authorization, defined in .
An OPTIONAL <statusSet:add> element that includes zero or more <statusSet:statusSet> elements that includes the unique name of the Status Set, defined in , to add to the EPP object.
An OPTIONAL <statusSet:rem> element that includes zero or more <statusSet:statusSet> elements that includes the unique name of the Status Set, defined in , to remove from the EPP object. The Status Set removes MUST be processed prior to the adds.

Example Domain Name Status Set Update Command that includes a single Authentication Token (M = 1 with M-of-N authorization) to authorize the update: C: C: C: C: C: example.com C: C: C: ns2.example.com C: C: C: C: C: ns1.example.com C: C: C: C: C: C: C: C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF C: C: C: C: ABC-12345 C: C: ]]> Example Domain Name Status Set Update Command that includes a two Authentication Tokens (M = 2 with M-of-N authorization) to authorize the update: C: C: C: C: C: example.com C: C: C: ns2.example.com C: C: C: C: C: ns1.example.com C: C: C: C: C: C: C: C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF C: C: C:eyJ0eXAiOiJKV1QiLA0KICabcJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJqb2UiLA0KICJ C:leHAiOjEzMDAabc4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp C:0cnVlfQ.dBjftJeZ4CVP-mB92K27abcuhbUJU1p1r_wW1gFWFOEjXk C: C: C: C: ABC-12345 C: C: ]]> Example Domain Name Status Set Update Command that includes a single Authentication Token (M = 1 with M-of-N authorization) to authorize removing the "Auth Token Lock" Status Set and adding the "Auth Token Lock - Transfer Allowed" Status Set, which removes the "clientTransferProhibited" Status Value from the domain name and keeps the "clientUpdateProhibited" and "clientDeleteProhibited" Status Values: C: C: C: C: C: example.com C: C: C: C: C: C: C:eyJhbGciOiJFUzUxMiIsInR5cCI6ImVhdCtqd3MiLCJraWQiOiJFQVRfS0VZMV9TWVN C:URU0tUkVQIn0.eyJqdGkiOiJFQVRfMTIzNDVfU1lTVEVNLVJFUCIsInN1YiI6IkNsaW C:VudFkiLCJleHAiOiIxNzc1NjgyMDAwIiwiZW50aXRsZW1lbnRzIjpbIlNFUlZJQ0UxL C:VJPIiwiU0VSVklDRTItUlciLCJUTEQxLVJXIiwiVExEMi1SVyJdfQ.ADJWkWMnZUFLl C:l2Jzxbw00919aC_qm_9UgeBKCY6MSAnVZtOmqVlE-Gfyut5dk7iU69VXKRi89RU3L4Y C:MyVvykFvAJm-aqNpHkYaYUZ_a0aZeN2KcVTVUXzPEtnq7kldvJTpYhB1-JmbFuQ2B6Z C:5PFZeR5k-ScmDEDdFl9nIFCLd5-mF C: C: C: Auth Token Lock - Transfer Allowed C: C: C: C: Auth Token Lock C: C: C: C: C: ABC-12345 C: C: ]]> This extension does not define any extension to the response of an <update> command. After processing the command, the server replies with a standard EPP response as defined in the EPP object mapping, such as defined in Section 3.2.4 of .

Formal Syntax An EPP object mapping is specified in XML Schema notation. The formal syntax presented here is a complete schema representation of the object mapping suitable for automated validation of EPP XML instances. The BEGIN and END tags are not part of the schema; they are used to note the beginning and ending of the schema for URI registration purposes. Extensible Provisioning Protocol v1.0 Status Set Extension. END]]>

IANA Considerations

XML Namespace This document uses URNs to describe XML namespaces and XML schemas conforming to a registry mechanism described in . The following URI assignment has been made by IANA: Registration request for the Status Set Extension Mapping namespace:

URI:: urn:ietf:params:xml:ns:epp:statusSet-0.1
Registrant Contact:: Registrant Contact: IESG
XML:: None. Namespace URIs do not represent an XML specification.

Registration request for the Status Set Extension Mapping XML Schema:

URI:: urn:ietf:params:xml:schema:epp:statusSet-0.1
Registrant Contact:: Registrant Contact: IESG
XML:: See the "Formal Syntax" section of this document.

EPP Extension Registry The EPP extension described in this document has been registered by IANA in the "Extensions for the Extensible Provisioning Protocol (EPP)" registry described in . The details of the registration are as follows:

Name of Extension:: "Status Set Extension Mapping for the Extensible Provisioning Protocol"
Document Status:: Standards Track
Reference:: (insert reference to RFC version of this document)
Registrant Name and Email Address:: IESG, <iesg@ietf.org>
TLDs:: Any
IPR Disclosure:: None
Status:: Active
Notes:: None

Security Considerations The mapping extensions described in this document extends the security services described by EPP and protocol layers used by EPP by using an Authentication Token, in draft-gould-regext-epp-auth-token, that is passed on top of EPP for registrar users to perform more fine grained authorization in the form of overriding a Client Status Set. The security considerations for the server include:

The Server Status Sets and the associated Server Status Values can only be managed by the server. The server MUST NOT allow the client to set, unset, or override a Server Status Set.
The authorization model for a server operation is driven by the mapping of the Status Values to the asasigned Status Sets. The server applies the Authentication Token, in draft-gould-regext-epp-auth-token, by matching the operation, the entitlements in the Authentication Token, and the assigned Client Status Sets to determine which Client Status Sets are overriden to authorize the execution of the operation.
Applying the inherited Client Staus Sets to the child objects (child host for parent domain name) MAY be enforced by the server business logic without having to directly change the child objects. There can be an unlimited number of child objects, so there is a resource consumption issue associated with cascading inherited Status Sets directly to the child objects.
Implementing the M-of-N authorization performs a intersection of the "entitlements" in the Authentication Tokens, in draft-gould-regext-epp-auth-token, when authorizing a Status Set Command.

The security considerations for the client include:

There are no additional client security considerations other than what's defined for the Authentication Token in draft-gould-regext-epp-auth-token.