src/site/xdoc/docs/developers/aci_aciitemasn1.xml - directory-server - Git at Google

 <?xml version="1.0" encoding="UTF-8"?>

 <document>
   <properties>
     <author email="ersiner">ersiner</author>
     <title>ApacheDS - ACIItem ASN.1 Grammar</title>
   </properties>
   <body>
     <section heading="h1" name="ACIItem grammar">
       <subsection heading="h2" name="ASN.1 Grammar">
         <p>
 The ASN.1 syntax for ACIItem of X.501 as given in the specificiation is as
 follows</p>
         <source>ACIItem ::= SEQUENCE {
 	identificationTag DirectoryString { ub-tag },
 	precedence Precedence,
 	authenticationLevel AuthenticationLevel,
 	itemOrUserFirst CHOICE {
 		itemFirst [0] SEQUENCE {
 			protectedItems ProtectedItems,
 			itemPermissions SET OF ItemPermission },
 		userFirst [1] SEQUENCE {
 			userClasses UserClasses,
 			userPermissions SET OF UserPermission } } }

 Precedence ::= INTEGER (0..255)

 ProtectedItems ::= SEQUENCE {
 	entry                          [0] NULL OPTIONAL,
 	allUserAttributeTypes          [1] NULL OPTIONAL,
 	attributeType                  [2] SET SIZE (1..MAX) OF AttributeType OPTIONAL,
 	allAttributeValues             [3] SET SIZE (1..MAX) OF AttributeType OPTIONAL,
 	allUserAttributeTypesAndValues [4] NULL OPTIONAL,
 	attributeValue                 [5] SET SIZE (1..MAX) OF AttributeTypeAndValue OPTIONAL,
 	selfValue                      [6] SET SIZE (1..MAX) OF AttributeType OPTIONAL,
 	rangeOfValues                  [7] Filter OPTIONAL,
 	maxValueCount                  [8] SET SIZE (1..MAX) OF MaxValueCount OPTIONAL,
 	maxImmSub                      [9] INTEGER OPTIONAL,
 	restrictedBy                   [10] SET SIZE (1..MAX) OF RestrictedValue OPTIONAL,
 	contexts                       [11] SET SIZE (1..MAX) OF ContextAssertion OPTIONAL,
 	classes                        [12] Refinement OPTIONAL }

 MaxValueCount ::= SEQUENCE {
 	type AttributeType,
 	maxCount INTEGER }

 RestrictedValue ::= SEQUENCE {
 	type AttributeType,
 	valuesIn AttributeType }

 UserClasses ::= SEQUENCE {
 	allUsers  [0] NULL OPTIONAL,
 	thisEntry [1] NULL OPTIONAL,
 	name      [2] SET SIZE (1..MAX) OF NameAndOptionalUID OPTIONAL,
 	userGroup [3] SET SIZE (1..MAX) OF NameAndOptionalUID OPTIONAL,
 		-- dn component shall be the name of an
 		-- entry of GroupOfUniqueNames
 	subtree   [4] SET SIZE (1..MAX) OF SubtreeSpecification OPTIONAL }

 ItemPermission ::= SEQUENCE {
 	precedence Precedence OPTIONAL,
 		-- defaults to precedence in ACIItem
 	userClasses UserClasses,
 	grantsAndDenials GrantsAndDenials }

 UserPermission ::= SEQUENCE {
 	precedence Precedence OPTIONAL,
 		-- defaults to precedence in ACIItem
 	protectedItems ProtectedItems,
 	grantsAndDenials GrantsAndDenials }

 AuthenticationLevel ::= CHOICE {
 	basicLevels SEQUENCE {
 	level ENUMERATED { none (0), simple (1), strong (2) },
 	localQualifier INTEGER OPTIONAL,
 	signed BOOLEAN DEFAULT FALSE },
 	other EXTERNAL }

 GrantsAndDenials ::= BIT STRING {
 	-- permissions that may be used in conjunction
 	-- with any component of ProtectedItems
 	grantAdd             (0),
 	denyAdd              (1),
 	grantDiscloseOnError (2),
 	denyDiscloseOnError  (3),
 	grantRead            (4),
 	denyRead             (5),
 	grantRemove          (6),
 	denyRemove           (7),
 	-- permissions that may be used only in conjunction
 	-- with the entry component
 	grantBrowse          (8),
 	denyBrowse           (9),
 	grantExport          (10),
 	denyExport           (11),
 	grantImport          (12),
 	denyImport           (13),
 	grantModify          (14),
 	denyModify           (15),
 	grantRename          (16),
 	denyRename           (17),
 	grantReturnDN        (18),
 	denyReturnDN         (19),
 	-- permissions that may be used in conjunction
 	-- with any component, except entry, of ProtectedItems
 	grantCompare         (20),
 	denyCompare          (21),
 	grantFilterMatch     (22),
 	denyFilterMatch      (23),
 	grantInvoke          (24),
 	denyInvoke           (25) }

 AttributeTypeAndValue ::= SEQUENCE {
 	type ATTRIBUTE.&amp;id ({SupportedAttributes}),
 	value ATTRIBUTE.&amp;Type({SupportedAttributes}{@type}) }
 </source>
       </subsection>
       <subsection heading="h2" name="BNF grammar">
         <p>
 Here is the BNF grammar of this ASN.1 grammar
 :</p>
         <source>&lt;wrapperEntryPoint&gt; ::= &lt;theACIItem&gt; EOF

 &lt;theACIItem&gt; ::=
     '{'
         &lt;spse&gt; &lt;aci_identificationTag&gt; &lt;spse&gt;
         ',' &lt;spse&gt; &lt;aci_precedence&gt; &lt;spse&gt;
         ',' &lt;spse&gt; &lt;aci_authenticationLevel&gt; &lt;spse&gt;
         ',' &lt;spse&gt; &lt;aci_itemOrUserFirst&gt; &lt;spse&gt;
     '}'

 &lt;aci_identificationTag&gt; ::= "identificationTag" &lt;sps&gt; SAFEUTF8STRING

 &lt;aci_precedence&gt; ::= "precedence" &lt;sps&gt; INTEGER

 &lt;aci_authenticationLevel&gt; ::= "authenticationLevel" &lt;sps&gt; &lt;basicLevels&gt;

 &lt;basicLevels&gt; ::= "basicLevels" &lt;spse&gt; ':' &lt;spse&gt; '{' &lt;spse&gt; &lt;level&gt; &lt;spse&gt; &lt;level_follower&gt; '}'

 &lt;level&gt; ::= "level" &lt;sps&gt; &lt;levels&gt;

 &lt;levels&gt; ::= "none" | "simple" | "strong"

 &lt;level_follower&gt; ::= ',' &lt;spse&gt; &lt;localQualifier_signed&gt; | e

 &lt;localQualifier_signed&gt; ::=
     "localQualifier" &lt;sps&gt; INTEGER &lt;spse&gt; &lt;signed_e&gt;
     | "signed" &lt;sps&gt; &lt;booleanValue&gt; &lt;spse&gt;

 &lt;signed_e&gt; ::= ',' &lt;spse&gt; "signed" &lt;sps&gt; &lt;booleanValue&gt; &lt;spse&gt; | e

 &lt;booleanValue&gt; ::= "FALSE" | "TRUE"

 &lt;aci_itemOrUserFirst&gt; ::= "itemOrUserFirst" &lt;sps&gt; &lt;itemOrUserFirst&gt;

 &lt;itemOrUserFirst&gt; ::= &lt;itemFirst&gt; | &lt;userFirst&gt;

 &lt;itemFirst&gt; ::= "itemFirst" ':' '{' &lt;spse&gt; &lt;protectedItems&gt; ',' &lt;spse&gt; &lt;itemPermissions&gt; &lt;spse&gt; '}'

 &lt;userFirst&gt; ::= "userFirst" ':' '{' &lt;spse&gt; &lt;userClasses&gt; ',' &lt;spse&gt; &lt;userPermissions&gt; &lt;spse&gt; '}'

 &lt;protectedItems&gt; ::= "protectedItems" &lt;spse&gt; '{' &lt;spse&gt; &lt;protectedItems_e&gt; &lt;spse&gt; '}'

 &lt;protectedItems_e&gt; ::= "entry" &lt;entry_follower_e&gt;
                 	| "allUserAttributeTypes" &lt;allUserAttributeTypes_follower_e&gt;
                 	| &lt;attributeType&gt; &lt;attributeType_follower_e&gt;
                 	| &lt;allAttributeValues&gt; &lt;allAttributeValues_follower_e&gt;
                 	| &lt;allUserAttributeTypesAndValues&gt; &lt;allUserAttributeTypesAndValues_follower_&gt;
                 	| ATTRIBUTE_VALUE_CANDIDATE &lt;attributeValue_follower_e&gt;
                 	| &lt;selfValue&gt; &lt;selfValue_follower_e&gt;
                 	| RANGE_OF_VALUES_CANDIDATE &lt;rangeOfValues_follower_e&gt;
                 	| &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
                 	| &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
                 	| &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
                 	| &lt;classes&gt;
 			| e

 &lt;entry_follower_e&gt; ::= ',' &lt;spse&gt; &lt;entry_follower&gt; | e

 &lt;entry_follower&gt; ::=
 	"allUserAttributeTypes" &lt;allUserAttributeTypes_follower_e&gt;
             | &lt;attributeType&gt; &lt;attributeType_follower_e&gt;
             | &lt;allAttributeValues&gt; &lt;allAttributeValues_follower_e&gt;
             | &lt;allUserAttributeTypesAndValues&gt; &lt;allUserAttributeTypesAndValues_follower_e&gt;
             | ATTRIBUTE_VALUE_CANDIDATE &lt;attributeValue_follower_e&gt;
             | &lt;selfValue&gt; &lt;selfValue_follower_e&gt;
             | RANGE_OF_VALUES_CANDIDATE &lt;rangeOfValues_follower_e&gt;
             | &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
             | &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;allUserAttributeTypes_follower_e&gt; ::= ',' &lt;spse&gt; &lt;allUserAttributeTypes_follower&gt; | e

 &lt;allUserAttributeTypes_follower&gt; ::=
             &lt;attributeType&gt; &lt;attributeType_follower_e&gt;
             | &lt;allAttributeValues&gt; &lt;allAttributeValues_follower_e&gt;
             | &lt;allUserAttributeTypesAndValues&gt; &lt;allUserAttributeTypesAndValues_follower_e&gt;
             | ATTRIBUTE_VALUE_CANDIDATE &lt;attributeValue_follower_e&gt;
             | &lt;selfValue&gt; &lt;selfValue_follower_e&gt;
             | RANGE_OF_VALUES_CANDIDATE &lt;rangeOfValues_follower_e&gt;
             | &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
             | &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;attributeType_follower_e&gt; ::= ',' &lt;spse&gt; &lt;attributeType_follower&gt; | e
 &lt;attributeType_follower&gt; ::=
             &lt;allAttributeValues&gt; &lt;allAttributeValues_follower_e&gt;
             | &lt;allUserAttributeTypesAndValues&gt; &lt;allUserAttributeTypesAndValues_follower_e&gt;
             | ATTRIBUTE_VALUE_CANDIDATE &lt;attributeValue_follower_e&gt;
             | &lt;selfValue&gt; &lt;selfValue_follower_e&gt;
             | RANGE_OF_VALUES_CANDIDATE &lt;rangeOfValues_follower_e&gt;
             | &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
             | &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&lt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;allAttributeValues_follower_e&gt; ::= ',' &lt;spse&gt; &lt;allAttributeValues_follower&gt; | e

 &lt;allAttributeValues_follower&gt; ::=
             &lt;allUserAttributeTypesAndValues&gt; &lt;allUserAttributeTypesAndValues_follower_e&gt;
             | ATTRIBUTE_VALUE_CANDIDATE &lt;attributeValue_follower_e&gt;
             | &lt;selfValue&gt; &lt;selfValue_follower_e&gt;
             | RANGE_OF_VALUES_CANDIDATE &lt;rangeOfValues_follower_e&gt;
             | &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
             | &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;allUserAttributeTypesAndValues_follower_e&gt; ::= ',' &lt;spse&gt; &lt;allUserAttributeTypesAndValues_follower&gt; | e

 &lt;allUserAttributeTypesAndValues_follower&gt; ::=
             ATTRIBUTE_VALUE_CANDIDATE &lt;attributeValue_follower_e&gt;
             | &lt;selfValue&gt; &lt;selfValue_follower_e&gt;
             | RANGE_OF_VALUES_CANDIDATE &lt;rangeOfValues_follower_e&gt;
             | &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
             | &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;attributeValue_follower_e&gt; ::= ',' &lt;spse&gt; &lt;attributeValue_follower&gt; | e

 &lt;attributeValue_follower&gt; ::=
             &lt;selfValue&gt; &lt;selfValue_follower_e&gt;
             | RANGE_OF_VALUES_CANDIDATE &lt;rangeOfValues_follower_e&gt;
             | &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
             | &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;selfValue_follower&gt; ::= ',' &lt;spse&gt; &lt;selfValue_follower&gt; | e

 &lt;selfValue_follower&gt; ::=
             RANGE_OF_VALUES_CANDIDATE &lt;rangeOfValues_follower_e&gt;
             | &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
             | &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;rangeOfValues_follower&gt; ::= ',' &lt;spse&gt; &lt;rangeOfValues_follower&gt; | e

 &lt;rangeOfValues_follower&gt; ::=
             &lt;maxValueCount&gt; &lt;maxValueCount_follower_e&gt;
             | &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;maxValueCount_follower&gt; ::= ',' &lt;spse&gt; &lt;maxValueCount_follower&gt; | e

 &lt;maxValueCount_follower&gt; ::=
             &lt;maxImmSub&gt; &lt;maxImmSub_follower_e&gt;
             | &lt;restrictedBy&gt; &lt;restrictedBy_follower_e&gt;
             | &lt;classes&gt;

 &lt;maxImmSub_follower&gt; ::= ',' &lt;spse&gt; &lt;maxImmSub_follower&gt; | e

 &lt;maxImmSub_follower&gt; ::=
 	    &lt;restrictedBy&gt; &lt;restrictedBy_follower&gt;
             | &lt;classes&gt;

 &lt;restrictedBy_follower&gt; ::= ',' &lt;spse&gt; &lt;classes&gt; | e

 &lt;attributeType&gt; ::= "attributeType" &lt;sps&gt; &lt;attributeTypeSet&gt;

 &lt;allAttributeValues&gt; ::= "allAttributeValues" &lt;sps&gt; &lt;attributeTypeSet&gt;

 &lt;allUserAttributeTypesAndValues&gt; ::= "allUserAttributeTypesAndValues"

 &lt;selfValue&gt; ::= "selfValue" &lt;sps&gt; &lt;attributeTypeSet&gt;

 &lt;maxValueCount&gt; ::= "maxValueCount" &lt;sps&gt; '{' &lt;spse&gt; &lt;aMaxValueCount&gt; &lt;spse&gt; &lt;aMaxValueCounts&gt; '}'

 &lt;aMaxValueCounts&gt; ::= ',' &lt;spse&gt; &lt;aMaxValueCount&gt; &lt;spse&gt; &lt;aMaxValueCounts&gt; | e

 &lt;aMaxValueCount&gt; ::= '{' &lt;spse&gt; "type" &lt;sps&gt; &lt;oid&gt; &lt;spse&gt; ',' &lt;spse&gt; "maxCount" &lt;sps&gt; INTEGER &lt;spse&gt; '}'

 &lt;maxImmSub&gt; ::= "maxImmSub" &lt;sps&gt; INTEGER

 &lt;restrictedBy&gt; ::= "restrictedBy" &lt;sps&gt; '{' &lt;spse&gt; &lt;restrictedValue&gt; &lt;spse&gt; &lt;restrictedValues&gt; '}'

 &lt;restrictedValues&gt; ::= ',' &lt;spse&gt; &lt;restrictedValue&gt; &lt;spse&gt; &lt;restrictedValues&gt; | e

 &lt;restrictedValue&gt; ::= '{' &lt;spse&gt; "type" &lt;sps&gt; &lt;oid&gt; &lt;spse&gt; ',' &lt;spse&gt; "valuesIn" &lt;sps&gt; &lt;oid&gt; &lt;spse&gt; '}'

 &lt;attributeTypeSet&gt; ::= '{' &lt;spse&gt; &lt;oid&gt; &lt;spse&gt; &lt;attributeTypeSets&gt; '}'

 &lt;attributeTypeSets&gt; ::= ',' &lt;spse&gt; &lt;oid&gt; &lt;spse&gt; &lt;attributeTypeSet&gt; | e

 &lt;classes&gt; ::= "classes" &lt;sps&gt; &lt;refinement&gt;

 &lt;itemPermissions&gt; ::= "itemPermissions" &lt;sps&gt; '{' &lt;spse&gt; &lt;itemPermission_e&gt; '}'

 &lt;itemPermission_e&gt; ::= &lt;itemPermission&gt; &lt;spse&gt; &lt;itemPermissions_e&gt; | e

 &lt;itemPermissions_e&gt; ::= ',' &lt;spse&gt; &lt;itemPermission&gt; &lt;spse&gt; &lt;itemPermissions_e&gt; | e

 &lt;itemPermission&gt; ::= '{' &lt;spse&gt; &lt;precedence_e&gt; &lt;spse&gt; '}'

 &lt;precedence_e&gt; ::=
     "precedence" &lt;sps&gt; INTEGER &lt;spse&gt; ',' &lt;spse&gt; &lt;userClasses&gt; &lt;spse&gt; ',' &lt;spse&gt; &lt;grantsAndDenials&gt;
     | &lt;userClasses&gt; &lt;spse&gt; ',' &lt;spse&gt; &lt;grantsAndDenials&gt;

 &lt;grantsAndDenials&gt; ::= "grantsAndDenials" &lt;sps&gt; '{' &lt;spse&gt; &lt;grantAndDenialsBit_e&gt; '}'

 &lt;grantAndDenialsBit_e&gt; ::= &lt;grantAndDenialsBit&gt; &lt;spse&gt; &lt;grantAndDenialsBits_e&gt; | e

 &lt;grantAndDenialsBits_e&gt; ::= ',' &lt;spse&gt; &lt;grantAndDenialsBit&gt; &lt;spse&gt; &lt;grantAndDenialsBits_e&gt; | e

 &lt;grantAndDenialsBit&gt; ::=
     "grantAdd" // (0),
     | "denyAdd" // (1),
     | "grantDiscloseOnError" // (2),
     | "denyDiscloseOnError" // (3),
     | "grantRead" // (4),
     | "denyRead" // (5),
     | "grantRemove" // (6),
     | "denyRemove" // (7),
     | "grantBrowse" // (8),
     | "denyBrowse" // (9),
     | "grantExport" // (10),
     | "denyExport" // (11),
     | "grantImport" // (12),
     | "denyImport" // (13),
     | "grantModify" // (14),
     | "denyModify" // (15),
     | "grantRename" // (16),
     | "denyRename" // (17),
     | "grantReturnDN" // (18),
     | "denyReturnDN" // (19),
     | "grantCompare" // (20),
     | "denyCompare" // (21),
     | "grantFilterMatch" // (22),
     | "denyFilterMatch" // (23),
     | "grantInvoke" // (24),
     | "denyInvoke" // (25)

 &lt;userClasses&gt; ::= "userClasses" &lt;sps&gt; '{' &lt;spse&gt; &lt;userClasses_e&gt; '}'

 &lt;userClasses_e&gt; ::=
             "allUsers" &lt;allUsers_follower_e&gt; &lt;spse&gt;
             | "thisEntry" &lt;thisEntry_follower_e&gt; &lt;spse&gt;
             | &lt;name&gt; &lt;name_follower_e&gt; &lt;spse&gt;
             | &lt;userGroup&gt; &lt;userGroup_follower_e&gt; &lt;spse&gt;
             | &lt;subtree&gt; &lt;spse&gt;
 	    | e

 &lt;allUsers_follower_e&gt; ::= ',' &lt;spse&gt; &lt;allUsers_follower&gt; | e

 &lt;allUsers_follower&gt; ::=
              "thisEntry" &lt;thisEntry_follower_e&gt;
              | &lt;name&gt; &lt;name_follower_e&gt;
              | &lt;userGroup&gt; &lt;userGroup_follower_e&gt;
              | &lt;subtree&gt;

 &lt;thisEntry_follower_e&gt; ::= ',' &lt;spse&gt; &lt;thisEntry_follower&gt; | e

 &lt;thisEntry_follower&gt; ::=
             &lt;name&gt; &lt;name_follower_e&gt;
             | &lt;userGroup&gt; &lt;userGroup_follower_e&gt;
             | &lt;subtree

 &lt;name_follower&gt; ::= ',' &lt;spse&gt; &lt;name_follower&gt; | e

 &lt;name_follower&gt; ::=
             &lt;userGroup&gt; &lt;userGroup_follower_e&gt;
             | &lt;subtree&gt;

 &lt;userGroup_follower_e&gt; ::= ',' &lt;spse&gt; &lt;subtree&gt; | e

 &lt;name&gt; ::= "name" &lt;sps&gt; '{' &lt;spse&gt; SAFEUTF8STRING &lt;spse&gt; &lt;names_e&gt; '}'

 &lt;names_e&gt; ::= ',' &lt;spse&gt; SAFEUTF8STRING &lt;spse&gt; &lt;names_e&gt; | e

 &lt;userGroup&gt; ::= "userGroup" &lt;sps&gt; '{' &lt;spse&gt; SAFEUTF8STRING &lt;spse&gt; &lt;userGroups_e&gt; '}'

 &lt;userGroups_e&gt; ::= ',' &lt;spse&gt; SAFEUTF8STRING &lt;spse&gt; &lt;userGroups_e&gt; | e

 &lt;subtree&gt; ::= "subtree" &lt;sps&gt; '{' &lt;spse&gt; &lt;subtreeSpecification&gt; &lt;spse&gt; &lt;subtrees_e&gt; '}'

 &lt;subtrees_e&gt; ::= ',' &lt;spse&gt; &lt;subtreeSpecification&gt; &lt;spse&gt; &lt;subtrees_e&gt; | e

 &lt;userPermissions&gt; ::= "userPermissions" &lt;sps&gt; '{' &lt;spse&gt; &lt;userPermissions_ee&gt; '}'

 &lt;userPermissions_ee&gt; ::= &lt;userPermission&gt; &lt;spse&gt; &lt;userPermissions_e&gt; | e

 &lt;userPermissions_e&gt; ::= ',' &lt;spse&gt; &lt;userPermission&gt; &lt;spse&gt; &lt;userPermissions_e&gt; | e

 &lt;userPermission&gt; ::= '{' &lt;spse&gt; &lt;precedence_ee&gt; &lt;spse&gt; '}'

 &lt;precedence_ee&gt; ::=
     "precedence" &lt;sps&gt; INTEGER &lt;spse&gt; ',' &lt;spse&gt; &lt;protectedItems&gt; &lt;spse&gt; ',' &lt;spse&gt; &lt;grantsAndDenials&gt;
     | &lt;protectedItems&gt; &lt;spse&gt; ',' &lt;spse&gt; &lt;grantsAndDenials&gt;

 &lt;subtreeSpecification&gt; ::= '{' &lt;spse&gt; &lt;subtreeSpecification_e&gt; '}'

 &lt;subtreeSpecification_e&gt; ::=
 	&lt;ss_base&gt; &lt;ss_base_follower_e&gt; &lt;spse&gt;
         | &lt;ss_specificExclusions&gt; &lt;ss_specificExclusions_follower_e&gt; &lt;spse&gt;
         | &lt;ss_minimum&gt; &lt;ss_minimum_follower_e&gt; &lt;spse&gt;
         | &lt;ss_maximum&gt; &lt;ss_maximum_follower_e&gt; &lt;spse&gt;
         | &lt;ss_specificationFilter&gt; &lt;spse&gt;
 	| e

 &lt;ss_base_follower_e&gt; ::= ',' &lt;spse&gt; &lt;ss_base_follower&gt; | e

 &lt;ss_base_follower&gt; ::=
             &lt;ss_specificExclusions&gt; &lt;ss_specificExclusions_follower_e&gt;
             | &lt;ss_minimum&gt; &lt;ss_minimum_follower_e&gt;
             | &lt;ss_maximum&gt; &lt;ss_maximum_follower_e&gt;
             | &lt;ss_specificationFilter&gt;

 &lt;ss_specificExclusions_follower_e&gt; ::= ',' &lt;spse&gt; &lt;ss_specificExclusions_follower&gt; | e

 &lt;ss_specificExclusions_follower&gt; ::=
             &lt;ss_minimum&gt; &lt;ss_minimum_follower_e&gt;
             | &lt;ss_maximum&gt; &lt;ss_maximum_follower_e&gt;
             | &lt;ss_specificationFilter&gt;

 &lt;ss_minimum_follower_e&gt; ::= ',' &lt;spse&gt; &lt;ss_minimum_follower&gt; | e

 &lt;ss_minimum_follower&gt; ::=
             &lt;ss_maximum&gt; &lt;ss_maximum_follower_e&gt;
             | &lt;ss_specificationFilter&gt;

 &lt;ss_maximum_follower_e&gt; ::= ',' &lt;spse&gt; &lt;ss_specificationFilter&gt; | e

 &lt;ss_base&gt; ::= "base" &lt;sps&gt; SAFEUTF8STRING

 &lt;ss_specificExclusions&gt; ::= "specificExclusions" &lt;sps&gt; &lt;specificExclusions&gt;

 &lt;specificExclusions&gt; ::= '{' &lt;spse&gt; &lt;specificExclusions_e&gt; '}'

 &lt;specificExclusions_e&gt; ::= &lt;specificExclusion&gt; &lt;spse&gt; &lt;specificExclusions_ee&gt; | e

 &lt;specificExclusions_ee&gt; ::= ',' &lt;spse&gt; &lt;specificExclusion&gt; &lt;spse&gt; &lt;specificExclusions_ee&gt; | e

 &lt;specificExclusion&gt; ::= "chopBefore" ':' SAFEUTF8STRING | "chopAfter" ':' SAFEUTF8STRING

 &lt;ss_minimum&gt; ::= "minimum" &lt;sps&gt; INTEGER

 &lt;ss_maximum&gt; ::= "maximum" &lt;sps&gt; INTEGER

 &lt;ss_specificationFilter&gt; ::= "specificationFilter" &lt;sps&gt; &lt;refinement&gt;

 &lt;oid&gt; ::= DESCR | NUMERICOID

 &lt;refinement&gt; ::= &lt;item&gt; | &lt;and&gt; | &lt;or&gt; | &lt;not&gt;

 &lt;item&gt; ::= "item" ':' &lt;oid&gt;

 &lt;and&gt; ::= "and" ':' &lt;refinements&gt;

 &lt;or&gt; ::= "or" ':' &lt;refinements&gt;

 &lt;not&gt; ::= "not" ':' &lt;refinements&gt;

 &lt;refinements&gt; ::= '{' &lt;spse&gt; &lt;refinements_e&gt; '}'

 &lt;refinements_e&gt; ::= &lt;refinement&gt; &lt;spse&gt; &lt;refinements_ee&gt; | e

 &lt;refinements_ee&gt; ::= ',' &lt;spse&gt; &lt;refinement&gt; &lt;spse&gt; &lt;refinements_ee&gt; | e

 &lt;sps&gt; ::= ' ' &lt;spse&gt;

 &lt;spse&gt; ::= ' ' &lt;spse&gt; | e


 // Lexer
 protected SAFEUTF8CHAR :
     '\u0001'..'\u0021' |
     '\u0023'..'\u007F' |
     '\u00c0'..'\u00d6' |
     '\u00d8'..'\u00f6' |
     '\u00f8'..'\u00ff' |
     '\u0100'..'\u1fff' |
     '\u3040'..'\u318f' |
     '\u3300'..'\u337f' |
     '\u3400'..'\u3d2d' |
     '\u4e00'..'\u9fff' |
     '\uf900'..'\ufaff' ;

 ',' : ',' ;

 ' ' : ' ' ;

 ':' : ':' ;

 protected DIGIT : '0' | LDIGIT ;

 protected LDIGIT : '1'..'9' ;

 protected ALPHA : 'A'..'Z' | 'a'..'z' ;

 protected INTEGER : DIGIT | ( LDIGIT ( DIGIT )+ ) ;

 protected HYPHEN : '-' ;

 protected NUMERICOID : INTEGER ( DOT INTEGER )+ ;

 protected DOT : '.' ;

 INTEGER_OR_NUMERICOID
     :
     ( INTEGER DOT ) =&gt; NUMERICOID
     |
     INTEGER
     ;

 SAFEUTF8STRING : '"'! ( SAFEUTF8CHAR )* '"'! ;

 DESCR
     :
     ( "attributeValue" ( ' '! )+ '{' ) =&gt;
       "attributeValue"! ( ' '! )+ '{'! (options { greedy=false;}:. )* '}'!
     | ( "rangeOfValues" ( ' '! )+ '(') =&gt;
       "rangeOfValues"! ( ' '! )+ '(' (options { greedy=false;}:. )* ')'
     | ALPHA ( ALPHA | DIGIT | HYPHEN )*
     ;
 </source>
       </subsection>
     </section>
   </body>
 </document>
	<?xml version="1.0" encoding="UTF-8"?>

	<document>
	<properties>
	<author email="ersiner">ersiner</author>
	<title>ApacheDS - ACIItem ASN.1 Grammar</title>
	</properties>
	<body>
	<section heading="h1" name="ACIItem grammar">
	<subsection heading="h2" name="ASN.1 Grammar">
	<p>
	The ASN.1 syntax for ACIItem of X.501 as given in the specificiation is as
	follows</p>
	<source>ACIItem ::= SEQUENCE {
	identificationTag DirectoryString { ub-tag },
	precedence Precedence,
	authenticationLevel AuthenticationLevel,
	itemOrUserFirst CHOICE {
	itemFirst [0] SEQUENCE {
	protectedItems ProtectedItems,
	itemPermissions SET OF ItemPermission },
	userFirst [1] SEQUENCE {
	userClasses UserClasses,
	userPermissions SET OF UserPermission } } }

	Precedence ::= INTEGER (0..255)

	ProtectedItems ::= SEQUENCE {
	entry [0] NULL OPTIONAL,
	allUserAttributeTypes [1] NULL OPTIONAL,
	attributeType [2] SET SIZE (1..MAX) OF AttributeType OPTIONAL,
	allAttributeValues [3] SET SIZE (1..MAX) OF AttributeType OPTIONAL,
	allUserAttributeTypesAndValues [4] NULL OPTIONAL,
	attributeValue [5] SET SIZE (1..MAX) OF AttributeTypeAndValue OPTIONAL,
	selfValue [6] SET SIZE (1..MAX) OF AttributeType OPTIONAL,
	rangeOfValues [7] Filter OPTIONAL,
	maxValueCount [8] SET SIZE (1..MAX) OF MaxValueCount OPTIONAL,
	maxImmSub [9] INTEGER OPTIONAL,
	restrictedBy [10] SET SIZE (1..MAX) OF RestrictedValue OPTIONAL,
	contexts [11] SET SIZE (1..MAX) OF ContextAssertion OPTIONAL,
	classes [12] Refinement OPTIONAL }

	MaxValueCount ::= SEQUENCE {
	type AttributeType,
	maxCount INTEGER }

	RestrictedValue ::= SEQUENCE {
	type AttributeType,
	valuesIn AttributeType }

	UserClasses ::= SEQUENCE {
	allUsers [0] NULL OPTIONAL,
	thisEntry [1] NULL OPTIONAL,
	name [2] SET SIZE (1..MAX) OF NameAndOptionalUID OPTIONAL,
	userGroup [3] SET SIZE (1..MAX) OF NameAndOptionalUID OPTIONAL,
	-- dn component shall be the name of an
	-- entry of GroupOfUniqueNames
	subtree [4] SET SIZE (1..MAX) OF SubtreeSpecification OPTIONAL }

	ItemPermission ::= SEQUENCE {
	precedence Precedence OPTIONAL,
	-- defaults to precedence in ACIItem
	userClasses UserClasses,
	grantsAndDenials GrantsAndDenials }

	UserPermission ::= SEQUENCE {
	precedence Precedence OPTIONAL,
	-- defaults to precedence in ACIItem
	protectedItems ProtectedItems,
	grantsAndDenials GrantsAndDenials }

	AuthenticationLevel ::= CHOICE {
	basicLevels SEQUENCE {
	level ENUMERATED { none (0), simple (1), strong (2) },
	localQualifier INTEGER OPTIONAL,
	signed BOOLEAN DEFAULT FALSE },
	other EXTERNAL }

	GrantsAndDenials ::= BIT STRING {
	-- permissions that may be used in conjunction
	-- with any component of ProtectedItems
	grantAdd (0),
	denyAdd (1),
	grantDiscloseOnError (2),
	denyDiscloseOnError (3),
	grantRead (4),
	denyRead (5),
	grantRemove (6),
	denyRemove (7),
	-- permissions that may be used only in conjunction
	-- with the entry component
	grantBrowse (8),
	denyBrowse (9),
	grantExport (10),
	denyExport (11),
	grantImport (12),
	denyImport (13),
	grantModify (14),
	denyModify (15),
	grantRename (16),
	denyRename (17),
	grantReturnDN (18),
	denyReturnDN (19),
	-- permissions that may be used in conjunction
	-- with any component, except entry, of ProtectedItems
	grantCompare (20),
	denyCompare (21),
	grantFilterMatch (22),
	denyFilterMatch (23),
	grantInvoke (24),
	denyInvoke (25) }

	AttributeTypeAndValue ::= SEQUENCE {
	type ATTRIBUTE.&id ({SupportedAttributes}),
	value ATTRIBUTE.&Type({SupportedAttributes}{@type}) }
	</source>
	</subsection>
	<subsection heading="h2" name="BNF grammar">
	<p>
	Here is the BNF grammar of this ASN.1 grammar
	:</p>
	<source><wrapperEntryPoint> ::= <theACIItem> EOF

	<theACIItem> ::=
	'{'
	<spse> <aci_identificationTag> <spse>
	',' <spse> <aci_precedence> <spse>
	',' <spse> <aci_authenticationLevel> <spse>
	',' <spse> <aci_itemOrUserFirst> <spse>
	'}'

	<aci_identificationTag> ::= "identificationTag" <sps> SAFEUTF8STRING

	<aci_precedence> ::= "precedence" <sps> INTEGER

	<aci_authenticationLevel> ::= "authenticationLevel" <sps> <basicLevels>

	<basicLevels> ::= "basicLevels" <spse> ':' <spse> '{' <spse> <level> <spse> <level_follower> '}'

	<level> ::= "level" <sps> <levels>

	<levels> ::= "none" \| "simple" \| "strong"

	<level_follower> ::= ',' <spse> <localQualifier_signed> \| e

	<localQualifier_signed> ::=
	"localQualifier" <sps> INTEGER <spse> <signed_e>
	\| "signed" <sps> <booleanValue> <spse>

	<signed_e> ::= ',' <spse> "signed" <sps> <booleanValue> <spse> \| e

	<booleanValue> ::= "FALSE" \| "TRUE"

	<aci_itemOrUserFirst> ::= "itemOrUserFirst" <sps> <itemOrUserFirst>

	<itemOrUserFirst> ::= <itemFirst> \| <userFirst>

	<itemFirst> ::= "itemFirst" ':' '{' <spse> <protectedItems> ',' <spse> <itemPermissions> <spse> '}'

	<userFirst> ::= "userFirst" ':' '{' <spse> <userClasses> ',' <spse> <userPermissions> <spse> '}'

	<protectedItems> ::= "protectedItems" <spse> '{' <spse> <protectedItems_e> <spse> '}'

	<protectedItems_e> ::= "entry" <entry_follower_e>
	\| "allUserAttributeTypes" <allUserAttributeTypes_follower_e>
	\| <attributeType> <attributeType_follower_e>
	\| <allAttributeValues> <allAttributeValues_follower_e>
	\| <allUserAttributeTypesAndValues> <allUserAttributeTypesAndValues_follower_>
	\| ATTRIBUTE_VALUE_CANDIDATE <attributeValue_follower_e>
	\| <selfValue> <selfValue_follower_e>
	\| RANGE_OF_VALUES_CANDIDATE <rangeOfValues_follower_e>
	\| <maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>
	\| e

	<entry_follower_e> ::= ',' <spse> <entry_follower> \| e

	<entry_follower> ::=
	"allUserAttributeTypes" <allUserAttributeTypes_follower_e>
	\| <attributeType> <attributeType_follower_e>
	\| <allAttributeValues> <allAttributeValues_follower_e>
	\| <allUserAttributeTypesAndValues> <allUserAttributeTypesAndValues_follower_e>
	\| ATTRIBUTE_VALUE_CANDIDATE <attributeValue_follower_e>
	\| <selfValue> <selfValue_follower_e>
	\| RANGE_OF_VALUES_CANDIDATE <rangeOfValues_follower_e>
	\| <maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>

	<allUserAttributeTypes_follower_e> ::= ',' <spse> <allUserAttributeTypes_follower> \| e

	<allUserAttributeTypes_follower> ::=
	<attributeType> <attributeType_follower_e>
	\| <allAttributeValues> <allAttributeValues_follower_e>
	\| <allUserAttributeTypesAndValues> <allUserAttributeTypesAndValues_follower_e>
	\| ATTRIBUTE_VALUE_CANDIDATE <attributeValue_follower_e>
	\| <selfValue> <selfValue_follower_e>
	\| RANGE_OF_VALUES_CANDIDATE <rangeOfValues_follower_e>
	\| <maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>

	<attributeType_follower_e> ::= ',' <spse> <attributeType_follower> \| e
	<attributeType_follower> ::=
	<allAttributeValues> <allAttributeValues_follower_e>
	\| <allUserAttributeTypesAndValues> <allUserAttributeTypesAndValues_follower_e>
	\| ATTRIBUTE_VALUE_CANDIDATE <attributeValue_follower_e>
	\| <selfValue> <selfValue_follower_e>
	\| RANGE_OF_VALUES_CANDIDATE <rangeOfValues_follower_e>
	\| <maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy< <restrictedBy_follower_e>
	\| <classes>

	<allAttributeValues_follower_e> ::= ',' <spse> <allAttributeValues_follower> \| e

	<allAttributeValues_follower> ::=
	<allUserAttributeTypesAndValues> <allUserAttributeTypesAndValues_follower_e>
	\| ATTRIBUTE_VALUE_CANDIDATE <attributeValue_follower_e>
	\| <selfValue> <selfValue_follower_e>
	\| RANGE_OF_VALUES_CANDIDATE <rangeOfValues_follower_e>
	\| <maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>

	<allUserAttributeTypesAndValues_follower_e> ::= ',' <spse> <allUserAttributeTypesAndValues_follower> \| e

	<allUserAttributeTypesAndValues_follower> ::=
	ATTRIBUTE_VALUE_CANDIDATE <attributeValue_follower_e>
	\| <selfValue> <selfValue_follower_e>
	\| RANGE_OF_VALUES_CANDIDATE <rangeOfValues_follower_e>
	\| <maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>

	<attributeValue_follower_e> ::= ',' <spse> <attributeValue_follower> \| e

	<attributeValue_follower> ::=
	<selfValue> <selfValue_follower_e>
	\| RANGE_OF_VALUES_CANDIDATE <rangeOfValues_follower_e>
	\| <maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>

	<selfValue_follower> ::= ',' <spse> <selfValue_follower> \| e

	<selfValue_follower> ::=
	RANGE_OF_VALUES_CANDIDATE <rangeOfValues_follower_e>
	\| <maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>

	<rangeOfValues_follower> ::= ',' <spse> <rangeOfValues_follower> \| e

	<rangeOfValues_follower> ::=
	<maxValueCount> <maxValueCount_follower_e>
	\| <maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>

	<maxValueCount_follower> ::= ',' <spse> <maxValueCount_follower> \| e

	<maxValueCount_follower> ::=
	<maxImmSub> <maxImmSub_follower_e>
	\| <restrictedBy> <restrictedBy_follower_e>
	\| <classes>

	<maxImmSub_follower> ::= ',' <spse> <maxImmSub_follower> \| e

	<maxImmSub_follower> ::=
	<restrictedBy> <restrictedBy_follower>
	\| <classes>

	<restrictedBy_follower> ::= ',' <spse> <classes> \| e

	<attributeType> ::= "attributeType" <sps> <attributeTypeSet>

	<allAttributeValues> ::= "allAttributeValues" <sps> <attributeTypeSet>

	<allUserAttributeTypesAndValues> ::= "allUserAttributeTypesAndValues"

	<selfValue> ::= "selfValue" <sps> <attributeTypeSet>

	<maxValueCount> ::= "maxValueCount" <sps> '{' <spse> <aMaxValueCount> <spse> <aMaxValueCounts> '}'

	<aMaxValueCounts> ::= ',' <spse> <aMaxValueCount> <spse> <aMaxValueCounts> \| e

	<aMaxValueCount> ::= '{' <spse> "type" <sps> <oid> <spse> ',' <spse> "maxCount" <sps> INTEGER <spse> '}'

	<maxImmSub> ::= "maxImmSub" <sps> INTEGER

	<restrictedBy> ::= "restrictedBy" <sps> '{' <spse> <restrictedValue> <spse> <restrictedValues> '}'

	<restrictedValues> ::= ',' <spse> <restrictedValue> <spse> <restrictedValues> \| e

	<restrictedValue> ::= '{' <spse> "type" <sps> <oid> <spse> ',' <spse> "valuesIn" <sps> <oid> <spse> '}'

	<attributeTypeSet> ::= '{' <spse> <oid> <spse> <attributeTypeSets> '}'

	<attributeTypeSets> ::= ',' <spse> <oid> <spse> <attributeTypeSet> \| e

	<classes> ::= "classes" <sps> <refinement>

	<itemPermissions> ::= "itemPermissions" <sps> '{' <spse> <itemPermission_e> '}'

	<itemPermission_e> ::= <itemPermission> <spse> <itemPermissions_e> \| e

	<itemPermissions_e> ::= ',' <spse> <itemPermission> <spse> <itemPermissions_e> \| e

	<itemPermission> ::= '{' <spse> <precedence_e> <spse> '}'

	<precedence_e> ::=
	"precedence" <sps> INTEGER <spse> ',' <spse> <userClasses> <spse> ',' <spse> <grantsAndDenials>
	\| <userClasses> <spse> ',' <spse> <grantsAndDenials>

	<grantsAndDenials> ::= "grantsAndDenials" <sps> '{' <spse> <grantAndDenialsBit_e> '}'

	<grantAndDenialsBit_e> ::= <grantAndDenialsBit> <spse> <grantAndDenialsBits_e> \| e

	<grantAndDenialsBits_e> ::= ',' <spse> <grantAndDenialsBit> <spse> <grantAndDenialsBits_e> \| e

	<grantAndDenialsBit> ::=
	"grantAdd" // (0),
	\| "denyAdd" // (1),
	\| "grantDiscloseOnError" // (2),
	\| "denyDiscloseOnError" // (3),
	\| "grantRead" // (4),
	\| "denyRead" // (5),
	\| "grantRemove" // (6),
	\| "denyRemove" // (7),
	\| "grantBrowse" // (8),
	\| "denyBrowse" // (9),
	\| "grantExport" // (10),
	\| "denyExport" // (11),
	\| "grantImport" // (12),
	\| "denyImport" // (13),
	\| "grantModify" // (14),
	\| "denyModify" // (15),
	\| "grantRename" // (16),
	\| "denyRename" // (17),
	\| "grantReturnDN" // (18),
	\| "denyReturnDN" // (19),
	\| "grantCompare" // (20),
	\| "denyCompare" // (21),
	\| "grantFilterMatch" // (22),
	\| "denyFilterMatch" // (23),
	\| "grantInvoke" // (24),
	\| "denyInvoke" // (25)

	<userClasses> ::= "userClasses" <sps> '{' <spse> <userClasses_e> '}'

	<userClasses_e> ::=
	"allUsers" <allUsers_follower_e> <spse>
	\| "thisEntry" <thisEntry_follower_e> <spse>
	\| <name> <name_follower_e> <spse>
	\| <userGroup> <userGroup_follower_e> <spse>
	\| <subtree> <spse>
	\| e

	<allUsers_follower_e> ::= ',' <spse> <allUsers_follower> \| e

	<allUsers_follower> ::=
	"thisEntry" <thisEntry_follower_e>
	\| <name> <name_follower_e>
	\| <userGroup> <userGroup_follower_e>
	\| <subtree>

	<thisEntry_follower_e> ::= ',' <spse> <thisEntry_follower> \| e

	<thisEntry_follower> ::=
	<name> <name_follower_e>
	\| <userGroup> <userGroup_follower_e>
	\| <subtree

	<name_follower> ::= ',' <spse> <name_follower> \| e

	<name_follower> ::=
	<userGroup> <userGroup_follower_e>
	\| <subtree>

	<userGroup_follower_e> ::= ',' <spse> <subtree> \| e

	<name> ::= "name" <sps> '{' <spse> SAFEUTF8STRING <spse> <names_e> '}'

	<names_e> ::= ',' <spse> SAFEUTF8STRING <spse> <names_e> \| e

	<userGroup> ::= "userGroup" <sps> '{' <spse> SAFEUTF8STRING <spse> <userGroups_e> '}'

	<userGroups_e> ::= ',' <spse> SAFEUTF8STRING <spse> <userGroups_e> \| e

	<subtree> ::= "subtree" <sps> '{' <spse> <subtreeSpecification> <spse> <subtrees_e> '}'

	<subtrees_e> ::= ',' <spse> <subtreeSpecification> <spse> <subtrees_e> \| e

	<userPermissions> ::= "userPermissions" <sps> '{' <spse> <userPermissions_ee> '}'

	<userPermissions_ee> ::= <userPermission> <spse> <userPermissions_e> \| e

	<userPermissions_e> ::= ',' <spse> <userPermission> <spse> <userPermissions_e> \| e

	<userPermission> ::= '{' <spse> <precedence_ee> <spse> '}'

	<precedence_ee> ::=
	"precedence" <sps> INTEGER <spse> ',' <spse> <protectedItems> <spse> ',' <spse> <grantsAndDenials>
	\| <protectedItems> <spse> ',' <spse> <grantsAndDenials>

	<subtreeSpecification> ::= '{' <spse> <subtreeSpecification_e> '}'

	<subtreeSpecification_e> ::=
	<ss_base> <ss_base_follower_e> <spse>
	\| <ss_specificExclusions> <ss_specificExclusions_follower_e> <spse>
	\| <ss_minimum> <ss_minimum_follower_e> <spse>
	\| <ss_maximum> <ss_maximum_follower_e> <spse>
	\| <ss_specificationFilter> <spse>
	\| e

	<ss_base_follower_e> ::= ',' <spse> <ss_base_follower> \| e

	<ss_base_follower> ::=
	<ss_specificExclusions> <ss_specificExclusions_follower_e>
	\| <ss_minimum> <ss_minimum_follower_e>
	\| <ss_maximum> <ss_maximum_follower_e>
	\| <ss_specificationFilter>

	<ss_specificExclusions_follower_e> ::= ',' <spse> <ss_specificExclusions_follower> \| e

	<ss_specificExclusions_follower> ::=
	<ss_minimum> <ss_minimum_follower_e>
	\| <ss_maximum> <ss_maximum_follower_e>
	\| <ss_specificationFilter>

	<ss_minimum_follower_e> ::= ',' <spse> <ss_minimum_follower> \| e

	<ss_minimum_follower> ::=
	<ss_maximum> <ss_maximum_follower_e>
	\| <ss_specificationFilter>

	<ss_maximum_follower_e> ::= ',' <spse> <ss_specificationFilter> \| e

	<ss_base> ::= "base" <sps> SAFEUTF8STRING

	<ss_specificExclusions> ::= "specificExclusions" <sps> <specificExclusions>

	<specificExclusions> ::= '{' <spse> <specificExclusions_e> '}'

	<specificExclusions_e> ::= <specificExclusion> <spse> <specificExclusions_ee> \| e

	<specificExclusions_ee> ::= ',' <spse> <specificExclusion> <spse> <specificExclusions_ee> \| e

	<specificExclusion> ::= "chopBefore" ':' SAFEUTF8STRING \| "chopAfter" ':' SAFEUTF8STRING

	<ss_minimum> ::= "minimum" <sps> INTEGER

	<ss_maximum> ::= "maximum" <sps> INTEGER

	<ss_specificationFilter> ::= "specificationFilter" <sps> <refinement>

	<oid> ::= DESCR \| NUMERICOID

	<refinement> ::= <item> \| <and> \| <or> \| <not>

	<item> ::= "item" ':' <oid>

	<and> ::= "and" ':' <refinements>

	<or> ::= "or" ':' <refinements>

	<not> ::= "not" ':' <refinements>

	<refinements> ::= '{' <spse> <refinements_e> '}'

	<refinements_e> ::= <refinement> <spse> <refinements_ee> \| e

	<refinements_ee> ::= ',' <spse> <refinement> <spse> <refinements_ee> \| e

	<sps> ::= ' ' <spse>

	<spse> ::= ' ' <spse> \| e




	// Lexer
	protected SAFEUTF8CHAR :
	'\u0001'..'\u0021' \|
	'\u0023'..'\u007F' \|
	'\u00c0'..'\u00d6' \|
	'\u00d8'..'\u00f6' \|
	'\u00f8'..'\u00ff' \|
	'\u0100'..'\u1fff' \|
	'\u3040'..'\u318f' \|
	'\u3300'..'\u337f' \|
	'\u3400'..'\u3d2d' \|
	'\u4e00'..'\u9fff' \|
	'\uf900'..'\ufaff' ;

	',' : ',' ;

	' ' : ' ' ;

	':' : ':' ;

	protected DIGIT : '0' \| LDIGIT ;

	protected LDIGIT : '1'..'9' ;

	protected ALPHA : 'A'..'Z' \| 'a'..'z' ;

	protected INTEGER : DIGIT \| ( LDIGIT ( DIGIT )+ ) ;

	protected HYPHEN : '-' ;

	protected NUMERICOID : INTEGER ( DOT INTEGER )+ ;

	protected DOT : '.' ;

	INTEGER_OR_NUMERICOID
	:
	( INTEGER DOT ) => NUMERICOID
	\|
	INTEGER
	;

	SAFEUTF8STRING : '"'! ( SAFEUTF8CHAR )* '"'! ;

	DESCR
	:
	( "attributeValue" ( ' '! )+ '{' ) =>
	"attributeValue"! ( ' '! )+ '{'! (options { greedy=false;}:. )* '}'!
	\| ( "rangeOfValues" ( ' '! )+ '(') =>
	"rangeOfValues"! ( ' '! )+ '(' (options { greedy=false;}:. )* ')'
	\| ALPHA ( ALPHA \| DIGIT \| HYPHEN )*
	;
	</source>
	</subsection>
	</section>
	</body>
	</document>