Subject: Authorization APIs

From: "Bob Blakley" <[email-masked]>
Date: Wed, 23 Feb 2000 17:56:42 -0600

All,

In Oslo I mentioned that we had a proposal for an authorization API in
consideration
for standardization at the Open Group.  This proposal has now been adopted
by the
Open Group, and the resulting final API is available in HTML format on the
Open Group
web site at:

        http://www.opengroup.org/publications/catalog/c908.htm#medium2

(you have to fill out a registration to get access to this; you can get the
.pdf free if you're
an Open Group member.  If anyone wants a copy of the .pdf and isn't a
member, please
get in touch with me privately via email and I'll try to arrange a free
review copy).

A number of commercial organizations have endorsed the API and made various
statements about implementation and exploitation; I can provide a list if
it's interesting;
IBM/Tivoli has already implemented and shipped the API in its Policy
Director product,
so it's possible to evaluate its capabilities "in use" if that's material.

I don't know what the group's general feeling is about progressing an
authorization
API definition on the standards track in CAT, but if there is interest in
doing this, I'd
like to have the group consider this API as well as GAA (I'm not necessarily
proposing
this as an alternative; Cliff and I have talked several times and my
impression is that
we are both willing to work together on some sort of compromise proposal
incorporating
the best elements of both APIs if this is considered desirable by the
group).

I'd be interested to hear from the list whether there's interest in
progressing *any*
authorization API on the standards track, or whether we're taking a
"wait-and-see"
attitude for a while.

--bob

Bob Blakley
Chief Scientist, Tivoli SecureWay Business Unit