RE: LDAPv3 Replication Access Control Design Team Report

Hi all,

Since "silence" seems not to be an option in this case, I'll log my opinion
here as siding IN FAVOR of the proposed work program.

My reasoning here is that I feel that
a) something needs to be done with respect to maintaining the security
around information access, even when that information is subject to being
replicated across a heterogeneous set of servers
b) mandating any one particular access control model implementation is (as
has been noted) a "rat hole" that is too deep and slimy to be productive
c) a mechanism for identifying an access control model + agreement that,
within an area of replication, a single access control model is applied is
a good way to "isolate" this problem from the main LDUP tasks of defining a
replication model (wire flows, data formats, administrative actions).

By isolating the problem, we can "agree to disagree" (as a collective
group) and still make progress on a replication protocol.  The approach
will also allow for those that CAN come to some agreement on an access
control model to be able to employ LDUP mechanisms.

I think that inserting this "level of indirection" with respect to access
control model frees up the LDUP WG to concentrate on replication flows
instead of being "stuck" as it has been for quite some time.

Regards,
Tim Hahn

Internet: [email protected]
Internal: Timothy Hahn/Durham/IBM@IBMUS
phone: 919.224.1565     tie-line: 8/687.1565
fax: 919.224.2540