Subject: Re: Considering Attribute Subtypes during ACL evaluation

From: "Jim Sermersheim" <[email-masked]>
Date: Mon, 02 Oct 2000 16:40:19 -0600

I agree for the exact same reason optional support of attr subtyping). It would also be interesting to hear from the X.500 community on how this is handled by different vendors. I found the whole thing unspecified.

Jim

>>> "Kurt D. Zeilenga" <[email-masked]> 9/30/00 12:59:03 PM >>>
At 07:39 AM 9/30/00 -0700, Prasanta Behera wrote:
>Currently  the netscape/iPlanet DS ACL supports a attribute inheritance of subtypes e.g. if you allow access to 
>"cn", it automatically means { cn, cn;* } 
>
>However, it is much harder to map "name" to "cn, sn". 

Depends upon your server implementation...  I argue that
mapping "name" to "cn" is no harder than mapping "2.5.4.3"
to "cn".  Both require schema aware ACL evaluation and
once you have that, supporting subtyping is likely no big
deal. Implementing schema aware ACL evaluation may be hard,
but it's already required to handle alternative naming
of attribute types.

However, given that subtyping is optional in LDAPv3, one
could argue it's best to leave subtyping within ACLs as
being optional.

Kurt

---

From: "Steven Legg" <[email-masked]>
Date: Mon, 9 Oct 2000 10:15:49 +1100

Jim,

I can't find anything in X.500 that clarifies whether attribute subtyping
applies when evaluating access controls. Our implementation ignores
subtyping when making access control decisions. It seems the safer
choice.

Regards,
Steven

-----Original Message-----
From: Jim Sermersheim [mailto:[email-masked]]
Sent: Tuesday, 3 October 2000 9:40
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: Considering Attribute Subtypes during ACL evaluation

I agree for the exact same reason optional support of attr subtyping). It
would also be interesting to hear from the X.500 community on how this is
handled by different vendors. I found the whole thing unspecified.

Jim

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 08 Oct 2000 18:00:24 -0700

At 10:15 AM 10/9/00 +1100, Steven Legg wrote:
>subtyping when making access control decisions.

What does it do for language tags and ;binary?  These are forms
of subtyping as well.

>It seems the safer choice.

X.500 doesn't have attribute type options, so direct comparisons
are invalid.  With the advent of LDAP attribute type options, in
particular, language tags and ;binary, I believe it very important
for that an ACI for "cn" apply not only to "cn" but "cn;lang-en"
and "cn;binary".   I would argue it best that if atribute type
option subtyping is supported, then traditional X.500 subtyping
should be supported as well (or at least allowed).

Kurt

---

From: "Steven Legg" <[email-masked]>
Date: Mon, 9 Oct 2000 14:42:30 +1100

Kurt,

> From: Kurt D. Zeilenga [mailto:[email-masked]]
> Sent: Monday, 9 October 2000 12:00
> To: [email-masked]
> Cc: 'Jim Sermersheim'; [email-masked]
> Subject: RE: Considering Attribute Subtypes during ACL evaluation
> 
> 

We have to be able to shuffle attribute types with language tags
through DSP somehow, so we define attribute types with language
tags as formal attribute subtypes in the X.500 sense (we don't
support contexts). Obviously that means we are restricted to single
inheritance. The access control decision function ignores subtyping
so access controls on cn don't apply to cn;lang-en.

We treat the ;binary option as a transfer encoding specifier,
rather than as a subtype. It only determines how the attributes
values are encoded to go out or come in. The bulk of the server
code cares nothing about ;binary. The access control decision
function, in particular, will appear to apply access controls
on cn to cn;binary as well.
 
> are invalid.

I wouldn't say that. The question is whether LDAP access controls on
a supertype should apply to the subtype. We are not prevented
from looking elsewhere for inspiration. Whether X.500 access control
does or doesn't support subtyping is still a worthwhile question,
even though the answer does not constrain LDAP access control in any
way because we are talking about an unrelated access control scheme.

> With the advent of LDAP attribute type options, in

The concern with this sort of inheritance is that the access controls
may later apply to things that the access control creator was not
aware of at the time of creation. If there is no inheritance there
can be no surprises. By the way, I'm not strongly for or against
such inheritance.

Regards,
Steven

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 08 Oct 2000 21:40:51 -0700

At 02:42 PM 10/9/00 +1100, Steven Legg wrote:
>aware of at the time of creation.

AND could not be aware of... (e.g. arbitrary language tags)

>If there is no inheritance there
>can be no surprises.

And no way for clients to specify language tags which are not
explicitly allowed by access controls. 

>By the way, I'm not strongly for or against
>such inheritance.

I guess I'm strong in favor of allowing an attribute type
description to be controlled by an ACI granting access to
the attribute type.  Without out such, managing access to
language tags is a real pain.

Beyond that, my feelings are less strong...

Kurt