Subject: Latest in-process draft

From: Doug Royer <[email-masked]>
Date: Sun, 20 Feb 2000 11:09:34 -0800

I have placed the latest CAP draf at:

	ftp://royer.com/pub/CALSCH

Included is cap.txt, the source file cap.nr, and a Makefile using gnu tools.

Steve Mansour and myself currently have access to modify the files
@home.royer.com.
And these will be pushed to ftp://royer.com/pub/CALSCH .

Any modification suggestions (other than typo's and simple formatting errors)
MUST be sent to the list before they will be included. Typos and formatting
errors can be sent to the list or directly to the editors.

I am setting up an automated process to notify this list whenever
cap.txt is updated by any one of the editors. This script will run
once per day and generate email only when cap.txt changes.

-Doug

---

From: [email-masked] (Richard Shusterman)
Date: Mon, 21 Feb 2000 11:13:52 -0800

Doug,

I quickly scanned this draft and did not see any of the text that was generated
at the Boston meeting and sent to this list included in this latest draft. Can
you please update this draft with that text. I realize there are some discussions
that still need to be made around some of this text but a number of us did spend
2 full days working on this text AND I didn't see any major objections to it's
inclusion. If you need me to point you to emails with the relevant text, I can do
that.

Thanks,
Richard

---

From: [email-masked] (Steve Mansour)
Date: Mon, 21 Feb 2000 11:37:27 -0800

I sent the .nr and .txt files to Paul who was going to insert the text and provide
more explanation. If you point me to the exact text you want put in the spec I'll do
that this afternoon.
-Steve

---

From: [email-masked] (Richard Shusterman)
Date: Mon, 21 Feb 2000 11:50:56 -0800

Part I was contained in Bob Mahoney's email of 1/26/00 at 12:48PM PST entitled "W-19 CAP
Group Definitions - corrections to yesterday's work". Part II was contained in Paul
Hill's emails of 1/27/00 at 12:47PM PST entitled "revised UPN definition" and 1/27/00 at
7:59AM PST entitled "revised security section".

---

From: Doug Royer <[email-masked]>
Date: Mon, 21 Feb 2000 13:18:22 -0800

> inclusion. If you need me to point you to emails with the relevant text, I can do

As steve pointed out it is in the works.

Also, I still do not understand some of the text as I still have unanswered
questions that I have posted. In summary (with respect to trying to generate
a VCAR for an anonymous UPN):

	Anonymous - looked ambiguous in the text. What is an anonymous UPN?

	Anonymous from any domain or any @specifc-domain. I could not tell which.

	There may have been more.

Also, some ABNF or examples needs to be updated to show how to use them.

-Doug

---

From: David Madeo <[email-masked]>
Date: Tue, 22 Feb 2000 12:11:29 -0500

>         Anonymous from any domain or any @specifc-domain. I could not tell which.

A totally anonymous UPN is "@".   It may be possible to authenticate
using a SASL method, but obtain the "domain anonymous" UPN such as
"@example.com".  This means you can be identified as someone from
example.com, but we're not sure which person.

It's important to distinguish between UPN's and ACL pattern matches. 
ACL's currently require a UPN.  We've also discussed putting pattern
matches into ACL rules as well as definitive UPN's.  So I may choose to
let "@" see my freebusy time, "@example.com" see certain types of data
and "[email-masked]" see everything.  This translates to
anyone can see my freebusy.  Anyone who can authenticate at example.com
can see certain types of data and that specific UPN can see everything.

A simple example:
Using SASL, I can authenticate as me and get my normal UPN
"[email-masked]".  Or I could authenticate as me and ask for another
UPN.  Whichever authentication method I use can look up to see if I'm
allowed to ask for that particular UPN and either allow or disallow it. 
The CU trusts the SASL methods to only give it UPN's that are properly
authorized.  I ask to see the calendar  calid://example.com/a9dfhj23jf
which has an ACL which says "[email-masked]" is an owner.  I can
modify the calendar as much as I'd like.  I then ask to see
calid://example.com/89jadf77adf which has an ACL saying "@example.com"
has full read access.  Because my UPN is "[email-masked]", and the
ACL says "@example.com", I should then have full read access.

Hope this clarifies things.

dmadeo

---

From: Doug Royer <[email-masked]>
Date: Sun, 27 Feb 2000 11:18:18 -0800

> example.com, but we're not sure which person.

How does a CAP CUA 'obtain' it over the wire?

> can see certain types of data and that specific UPN can see everything.

I would be for that.

> UPN.

How does a CAP CUR ask for 'another UPN'?

>  Whichever authentication method I use can look up to see if I'm

With UPNEXPAND I can expand one UPN into multiple.

How does a CAP CUA ask to use a particularly UPN?
How does a CS or a CAP CUA allow or disallow it (I assume you mean access to
use the selected UPN)?

> authorized. 

I assume 'it' is the CU? Is this via UPNEXPAND? Or as part
of the AUTHENTICATE reply?

> I ask to see the calendar  calid://example.com/a9dfhj23jf

Okay so that's how you could do wild card matches.

How do you use/select another UPN?

-Doug