RE: LDAPv3 Replication Access Control Design Team Report
"Timothy Hahn" <[email protected]> Tue, 10 Sep 2002 09:04:36 -0400
| Newsgroups | gmane.ietf.ldup |
|---|---|
| Message-ID | <[email protected]> |
Kurt, My opinions below. Regards, Tim Hahn Internet: [email protected] Internal: Timothy Hahn/Durham/IBM@IBMUS phone: 919.224.1565 tie-line: 8/687.1565 fax: 919.224.2540 "Kurt D. Zeilenga" To: <[email protected]> <[email protected] cc: <[email protected]> g> Subject: RE: LDAPv3 Replication Access Control Design Team Report Sent by: owner-ietf-ldup@m ail.imc.org 09/10/2002 08:42 AM Let's cut to the key question: Does LDAP replication REQUIRE a standard LDAP ACM? (REQUIRE here in the RFC 2119 sense). TJH> I believe that LDAP replication MUST ensure that the security TJH> (i.e. authorization to access - add/modify/search/delete) TJH> is NOT compromised by the LDAP replication mechanism defined. TJH> TJH> Thus, I believe that LDAP replication REQUIRES that access TJH> control issues be "attended to" (in the RFC 2119 sense). TJH> TJH> But I DO NOT feel that LDAP replication needs define a specific TJH> Access Control Model (ACM). LDAP replication need only ensure TJH> that SOME ACM can be applied across the servers involved in the TJH> data replicated amongst them and that LDAP replication doesn't TJH> "mess that up". If the consensus is yes, then we should determine how this requirement is going to be fulfilled. (I note that the proposed plan doesn't produce a standard LDAP ACM.) If the consensus is no, then we need not determine how an LDAP ACM will or will not be produced. It simply can remain out of scope. TJH> Unfortunately, I don't believe the answer is as "binary" TJH> as this. LDAP replication REQUIRES that things be done TJH> "securely" but it does NOT REQUIRE a specific ACM. I see little point is discussing the details of the plan until we've actually agreed upon requirements... Kurt