Subject: Re: forced VCAR (was: revised security section)

From: [email-masked]
Date: Thu, 3 Feb 2000 06:37:28 -0500

Paul wrote, in part:
> IMHO setting an enforceable CS policy fails the test that we have been
> using, therefore CAP should not address this topic.

I am probably not certain what you completely mean by "enforcable", but 
Lotus definitely believes that CS VCAR access policy needs to be an 
initial CAP target for VCAR specification in Version 1.
For example, "GRANT View Public Entries" or "GRANT View Busy Time 
Information" or "GRANT Create and Update Public Entries" or "DENY Create, 
Update and Delete Entries".
-- Frank

---

From: "Paul B. Hill" <[email-masked]>
Date: Thu, 03 Feb 2000 11:22:55 -0500

Hi Frank,

I can't figure out if we agree or disagree yet. I suspect that we actually 
agree, please read on.

 >I am probably not certain what you completely mean by "enforcable", but 
Lotus definitely >believes that CS VCAR access policy needs to be an 
initial CAP target for VCAR specification >in Version 1.

OK, "enforceable" was a poor term to use. Maybe "imposed", "decreed", 
"established by edict" are better terms to describe the concept. The idea, 
as I understood it, was that a CS MAY choose to implement and allow 
persistent immutable VCARs, that are configured by the CS Administrator, 
which apply to all calendars on the server. For example a company may 
decide that it wants all calendars on its server(s) to have the Policy 
READBUSYTIMEINFO.

 >For example, "GRANT View Public Entries" or "GRANT View Busy Time 
Information" or "GRANT >Create and Update Public Entries" or "DENY Create, 
Update and Delete Entries".

But aren't you talking about the end user performing these operations on 
calendars that they control?

I'm talking about the case where a CS implementation allows the CS admin to 
impose "GRANT READBUSYTIMEINFO" to all calendars. If a user subsequently 
attempts to modify this to  "DENY READBUSYTIMEINFO" on a specific calendar 
an error will be returned to the user.

First, I do not think that all CSes must be required to implement the 
ability to create global immutable VCARs. I think this is a feature that 
each CS vendor should be free to implement or not.

Second, I do not think that the CAP protocol needs to define how the CS 
admin would  communicate with the CS to enact or create a global immutable 
VCAR by decree.

Paul

---

From: David Madeo <[email-masked]>
Date: Thu, 03 Feb 2000 12:12:08 -0500

> an error will be returned to the user.

This error should be clear that it's because the server is forcing this, not
just a permission denied.

> each CS vendor should be free to implement or not.

Agreed, though a "PLEASE" would be nice.

> Second, I do not think that the CAP protocol needs to define how the CS admin
> would  communicate with the CS to enact or create a global immutable VCAR by
> decree.

Agreed.  There's no need for CAP to define this, it's probably defined in a
text file on the server.

I liked Doug's point that it would be good for the CUA to know that it won't be
able to modify this particular VCAR though.

Unless anyone else has something to say, I think we're done with the issue and
just need to write some text.

Thanks,

dmadeo

---

From: Doug Royer <[email-masked]>
Date: Thu, 03 Feb 2000 10:33:46 -0800

> just a permission denied.

After thinking about this more ...

If a CS implementation wishes to force a VCAR, it simply tells everyone
by exporting (when asked) a valid VCAR that disallows changes.

 --> There is no need for the READ-ONLY text that I sent out earlier.

To a CU - what's the difference? They will have a VCAR that dis-allows
them to modify their VCAR as in this example VCAR that disallows itslef
to be changed and defines that VFREEBUSY is readable:

		BEGIN:VCAR
		CARID:Forced VFREEBUSY access to READ
		DENY:UPN=all;OBJECT=VCAR
		 ;OBJECT=CARID;VALUE="Forced VFREEBUSY access to READ"
		 ;ACCESS=DELETE,MODIFY
		GRANT:UPN=all;OBJECT=VFREEBUSY;ACCESS=READ
		END:VCAR

It grants read accesss to VFREEBUSY, and denies any user from changing it
So if this VCAR exists, what is the difference to a CU or CUA if it
is FORCED or NOT?