RE: Adding to the LDAP ACM to a WG charter

The non-sequitor you point to is a typo on my part.
I meant to say that the ACM work cannot be finished in LDAPext
because that group is shutting down.
Ellen

At 11:17 AM 11/19/2001 -0700, you wrote:
>I didn't quite follow that, Ellen - "since this work cannot be finished
>in LDUP (ldapext is shutting down)" seems like a non-sequitor.  Did
>you mean it can't be done in LDAPEXT?
>
>I come down in favor of a separate working group to hash out
>the end-all-and-be-all Access Control Model, or even an appropriate
>subset.
>
>In addition to the list of issues that Kurt raised, I'll point
>out that the X.500 model also includes provisions for Rule Based
>Access Control, which takes determination of appropriate
>security clearances, roles, etc. to be more important than the
>actual identity of the security principal, which is a particularly
>important manner of access control among very large, independently
>administered heterogeneous communities like the Internet.
>
>The X.500 work was, I think, done to address data handling
>constraints associated with the US DOD Defence Messaging System
>design, which is not getting much press today.
>
>However, the notion that interoperability between companies
>should follow a model that allows data administrators in the directory
>to set classification of data that requires role and clearance
>information to be authoritatively provided, without necessarily
>having any knowledge at all about the actual identity of the
>principal (anonymous, but trusted, vs anonymous and untrusted)
>is very attractive.
>
>Kurt's list of Authentication issues to discuss, together with the
>X.500 notion of Rule Based Authorization and the current market
>craze in favor of Role Based Authentication (where the ACI
>refers to a role, not an individual, and it's the job of the
>authentication service to provide information about the roles
>and clearance of the principal to relying services like the directory)
>should NOT be dealt with in LDUP, but rather a separate
>LDAPACM working group.
>
>The (proposed new) LDAPACM working group should work diligently
>to (a) not break LDAP, (b) store its policy and principal information
>in the Directory so that LDUP will replicate it, and detail as much
>as possible what special provisions, if any, are needed in LDUP to
>preserve the integrity of the ACM information.  For instance,
>it might very well be a requirement that ACM information
>be sent by state-based replication schemes in LDUP BEFORE any
>of the data elements to which it applies is sent.
>
>I vote in favor of NOT doing LDAPACM in LDUP, but rather
>leaving LDUP to the task of shipping directory information around
>"safely", while leaving LDAPACM the opportunity to place
>SOME requirements on LDUP when those requirements are fully
>known.
>
>LDUP is useful (as was LDAPv2 and LDAPv3) even if it does not provide
>a complete, seamless, end-to-end, multi-vendor environment with
>a perfectly consistent management and security policy implementation.
>
>Lets get on with discovering what some of those uses are.
>
>Ed
>
>=================
>Ed Reed
>Reed-Matthews, Inc.
>+1 585 624 2402
>http://www.Reed-Matthews.COM
>Note:  Area code is 585
>
> >>> Ellen Stokes <[email protected]> 11/17/01 12:40PM >>>
>
>Security is important for a replicated environment.
>
>For the secure replicated heterogeneous environment to work, an
>access control model is necessary.
>
>Since this work cannot be finished in LDUP (ldapext is shutting
>down), the access control model needs a home.
>
>And given the complexity of the topic, it is insufficient to just
>release the spec as informational, experimental, or as an
>individual publication.
>
>I am FOR adding access control model to LDUP.
>
>Ellen