Re: Avoiding IBAC

David Nicol wrote:
> 
> The Cisco AAA abstraction uses just three, Authentication,
> Authorization, Accounting. Most discussion here falls in the realm of
> the second A.
>
There are two aspects to authorization.

1. Deciding whether or not  a request is authorized is the main topic discussed here.
2. Deciding whether or not to grant an authorization is not usually discussed here.

In other words, we discuss the easier problem of mechanism and largely ignore the harder problem of policy.

________________________
Alan Karp
Principal Scientist
Enterprise Services, Office of the CTO
Hewlett-Packard Company
1501 Page Mill Road
Palo Alto, CA 94304
(650) 857-3967, fax (650) 857-7029
http://www.hpl.hp.com/personal/Alan_Karp