RE: Adding to the LDAP ACM to a WG charter

I didn't quite follow that, Ellen - "since this work cannot be finished
in LDUP (ldapext is shutting down)" seems like a non-sequitor.  Did
you mean it can't be done in LDAPEXT?

I come down in favor of a separate working group to hash out
the end-all-and-be-all Access Control Model, or even an appropriate
subset.  

In addition to the list of issues that Kurt raised, I'll point
out that the X.500 model also includes provisions for Rule Based
Access Control, which takes determination of appropriate 
security clearances, roles, etc. to be more important than the
actual identity of the security principal, which is a particularly
important manner of access control among very large, independently
administered heterogeneous communities like the Internet.

The X.500 work was, I think, done to address data handling
constraints associated with the US DOD Defence Messaging System
design, which is not getting much press today.

However, the notion that interoperability between companies
should follow a model that allows data administrators in the directory
to set classification of data that requires role and clearance
information to be authoritatively provided, without necessarily
having any knowledge at all about the actual identity of the
principal (anonymous, but trusted, vs anonymous and untrusted)
is very attractive.

Kurt's list of Authentication issues to discuss, together with the
X.500 notion of Rule Based Authorization and the current market
craze in favor of Role Based Authentication (where the ACI
refers to a role, not an individual, and it's the job of the
authentication service to provide information about the roles
and clearance of the principal to relying services like the directory)
should NOT be dealt with in LDUP, but rather a separate
LDAPACM working group.

The (proposed new) LDAPACM working group should work diligently
to (a) not break LDAP, (b) store its policy and principal information
in the Directory so that LDUP will replicate it, and detail as much
as possible what special provisions, if any, are needed in LDUP to
preserve the integrity of the ACM information.  For instance, 
it might very well be a requirement that ACM information
be sent by state-based replication schemes in LDUP BEFORE any
of the data elements to which it applies is sent.

I vote in favor of NOT doing LDAPACM in LDUP, but rather
leaving LDUP to the task of shipping directory information around
"safely", while leaving LDAPACM the opportunity to place
SOME requirements on LDUP when those requirements are fully 
known.

LDUP is useful (as was LDAPv2 and LDAPv3) even if it does not provide
a complete, seamless, end-to-end, multi-vendor environment with
a perfectly consistent management and security policy implementation.

Lets get on with discovering what some of those uses are.

Ed

=================
Ed Reed
Reed-Matthews, Inc.
+1 585 624 2402
http://www.Reed-Matthews.COM
Note:  Area code is 585

>>> Ellen Stokes <[email protected]> 11/17/01 12:40PM >>>

Security is important for a replicated environment.

For the secure replicated heterogeneous environment to work, an
access control model is necessary.

Since this work cannot be finished in LDUP (ldapext is shutting
down), the access control model needs a home.

And given the complexity of the topic, it is insufficient to just
release the spec as informational, experimental, or as an
individual publication.

I am FOR adding access control model to LDUP.

Ellen