Re: Avoiding IBAC

On Sat, Oct 18, 2014 at 10:22 PM, Karp, Alan H <[email protected]> wrote:
> Rob Meijer wrote:
>>
>> Maybe we should make that seven:
>>
>> 5. attenuation : turning a right into a weaker version of that right
>> suitable for attenuated authorization (delegation).
>> 6. decomposition : turning a right to a composite into a right to a
>> component suitable for decomposed authorization (delegation)
>> 7. logging : keeping track of identities tied to authorizations and
>> honored requests for accountability purposes.
>>
> I can imagine adding a few more, too, but sometimes precision gets in the way of clarity.

The Cisco AAA abstraction uses just three, Authentication,
Authorization, Accounting. Most discussion here falls in the realm of
the second A.



-- 
Mmm, jelly donut.