1. Modifying Managed Objects Alan Frindell 3/29/2011

2. The Modify Problem As defined in 1.0, there is no mechanism to change the value of a managed object – only its attributes Managed cryptographic objects (keys, certs) appear immutable by design It is not possible to change the contents of an Opaque object in KMIP 1.0 – Client must destroy and re-Register – Results in UUID change If Entity is approved as a new managed object, the same problem will make it impossible to update Credentials

3. Solution A – re-use Modify Attribute Question: can all structures and fields defined outside of Section 3 be treated like attributes in all operations? Add Attribute and Delete Attribute also make sense What are the implications for Get Attributes / Get Attributes List / Locate? Operation: Modify Attribute UUID: Attribute: Attribute Name: "Opaque Object" Attribute Value: Structure (as defined in 2.2.8) Operation: Modify Attribute UUID: Attribute: Attribute Name: "Credential" Attribute Value: Structure (still TBD, but containing new password) Note: Even though Credential can be repeated inside Entity, it does not have an Attribute Index

4. Solution B – new operation: Modify Replace entire managed object with new managed object, retaining UUID and attributes Dodges “is everything an attribute question” Makes it challenging to add or delete a multi- valued structure field (eg: a Credential within an Entity) Operation: Modify UUID: Opaque Object: Structure (as defined in 2.2.8) Operation: Modify UUID: Entity: Structure Credential: Structure (TBD, containing new password)