Subject: Re: Considering Attribute Subtypes during ACL evaluation

From: [email-masked]
Date: Mon, 2 Oct 2000 05:52:26 -0400

Kurt,

I agree that the optional/mandatory specification for ACLs to be sensitive
to subtyping should follow what an implementation does with attribute
subtyping support, i.e. if attribute subtypes are supported, then the ACL
implementation should be sensitive to them as well.

Regards,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Endicott/IBM@IBMUS or IBMUSM00(HAHNT)
phone: 607.752.6388     tie-line: 8/852.6388
fax: 607.752.3681

"Kurt D. Zeilenga" <[email-masked]> on 09/30/2000 02:59:03 PM

To:   [email-masked] (Prasanta Behera)
cc:   Timothy Hahn/Endicott/IBM@IBMUS, [email-masked]
Subject:  Re: Considering Attribute Subtypes during ACL evaluation

At 07:39 AM 9/30/00 -0700, Prasanta Behera wrote:
>Currently  the netscape/iPlanet DS ACL supports a attribute inheritance of
subtypes e.g. if you allow access to
>"cn", it automatically means { cn, cn;* }
>
>However, it is much harder to map "name" to "cn, sn".

Depends upon your server implementation...  I argue that
mapping "name" to "cn" is no harder than mapping "2.5.4.3"
to "cn".  Both require schema aware ACL evaluation and
once you have that, supporting subtyping is likely no big
deal. Implementing schema aware ACL evaluation may be hard,
but it's already required to handle alternative naming
of attribute types.

However, given that subtyping is optional in LDAPv3, one
could argue it's best to leave subtyping within ACLs as
being optional.

Kurt

---

From: "Miklos, Sue A." <[email-masked]>
Date: Mon, 2 Oct 2000 08:25:22 -0400

I have an attribute type "userCertificate" and have many values (PKI A
certificate; PKI B certificate, etc.) 

My requirement is to constrain the management of that attribute value to the
CA or appropriate named authority for that attribute value.

I would not want to allow CA for PKI A to have all privileges wrt
userCertificate for PKI B.

as I read your proposal, I don't interpret this as supporting my
requirement.

is this correct?

Sandi

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Friday, September 29, 2000 5:53 PM
To: Jim Sermersheim
Cc: [email-masked]; Duane Buss
Subject: Re: Considering Attribute Subtypes during ACL evaluation

At 05:37 PM 9/28/00 -0600, Jim Sermersheim wrote:
>Are attribute subtypes considered when calculating access control
information? In other words, if I have read permission to the "name"
attribute, does that automatically give me read permission to sn, cn,
givenName, etc?
> 
>I can't find any coverage of this in X.511 or the latest ACL draft. Due to
the lack of anyone talking about it, my assumption is that, no, permissions
do not flow down attribute inheritance chains, they must be explicitly
stated for each attribute.
> 
>Of course with LDAP, this brings up the question of whether they apply to
attribute type options. It seems to make sense, under most circumstances, to
apply them in this case. Oh, what a world - what a world.

When I asked this question previously, the answer was "no, ACLs
apply only to the specified type, not subtypes".

I have argued that each ACL should be applied subtypes.  One
issue in adding such is which ACL takes precedence.  This is
complicated due to multiple inheritance due to attribute
description options.

One possible precedence:
        type;a;b;c
        type
        supertype;a;b;c
        supertype

Of course, if one of the options was "binary", it sure would be
nice to allow
        type;a;binary;c
        type;a;c
        type
        supertype;a;binary;c
        supertype;a;c
        supertype

But this seems overly complicated.  An alternative would be to
say that ACLs apply to attribute types, not attribute descriptions.
So, access to "type;a;b;c" would be governed by:
        type
        supertype

I prefer this.

Kurt

****************************************************************************
*
This confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.
****************************************************************************
**

---

From: "Skovgaard, Erik" <[email-masked]>
Date: Mon, 2 Oct 2000 10:09:58 -0700

Tim,
 
I am not so sure this is a good idea.  I may want to allow anonymous readers
access to sn, but not to gn, for instance.  While those of us "in the know"
may be able to set up a specific deny on gn, it may be less intuitive to
people with less knowledge of the standards.
 
Cheers,                                 ....Erik.
Erik Skovgaard
Siemens Meta-Directory Solutions
Phone: +1 604-204-0750
Fax:   +1 604-204-0760 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Saturday, September 30, 2000 04:13
To: [email-masked]
Subject: Re: Considering Attribute Subtypes during ACL evaluation

Jim, 

Good question! 

I know that implementing access control such that attribute inheritance were
taken into account would definitely be harder, but I feel that attribute
inheritance SHOULD be considered during access control checks. 

Thus, if some entity is granted read and write privileges to 'name', then
they should be allowed the same privileges to 'cn', 'sn', and 'cn;lang-en'.
(unless overidden by another permission that disallows such access).

Regards,
Tim Hahn

To:        <[email-masked]> 
cc:        "Duane Buss" <[email-masked]> 
Subject:        Considering Attribute Subtypes during ACL evaluation 

  
Of course with LDAP, this brings up the question of whether  they apply to
attribute type options. It seems to make sense, under most  circumstances,
to apply them in this case. Oh, what a world - what a  world.

---

From: [email-masked]
Date: Mon, 2 Oct 2000 20:36:19 -0400

Sandi,

As I understand the LDAP ACL draft, access control is not applied to
individual values within an attribute within an entry.  Access control
applies to all values for the attribute within the entry.  Thus, I believe
you are correct.

Regards,
Tim Hahn

"Miklos, Sue A." <[email-masked]> on 10/02/2000 08:25:22 AM

To:   "'Kurt D. Zeilenga'" <[email-masked]>, Jim Sermersheim
      <[email-masked]>
cc:   [email-masked], Duane Buss <[email-masked]>
Subject:  RE: Considering Attribute Subtypes during ACL evaluation

My requirement is to constrain the management of that attribute value to
the CA or appropriate named authority for that attribute value.

is this correct?

Sandi

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Friday, September 29, 2000 5:53 PM
To: Jim Sermersheim
Cc: [email-masked]; Duane Buss
Subject: Re: Considering Attribute Subtypes during ACL evaluation

One possible precedence:
        type;a;b;c
        type
        supertype;a;b;c
        supertype

I prefer this.

Kurt

*****************************************************************************

This confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.
******************************************************************************

---

From: "Miklos, Sue A." <[email-masked]>
Date: Tue, 3 Oct 2000 08:31:45 -0400

Thank you for the reply.

One of the thoughts we've had (maybe a dangerous thing) is to use the
subtyping capability and put some form of tag information into the attribute
type, indicating that it is of 'type RSA 2048' or 'type DSA 1024', etc. and
then try to apply ACIs against the type.

Seems like a particularly burdensome way to present a repository that can be
managed by differing CA domains.

any alternatives welcomed.

regards,
Sandi

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Monday, October 02, 2000 8:36 PM
To: [email-masked]
Subject: RE: Considering Attribute Subtypes during ACL evaluation

Sandi,

Regards,
Tim Hahn

is this correct?

Sandi

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Friday, September 29, 2000 5:53 PM
To: Jim Sermersheim
Cc: [email-masked]; Duane Buss
Subject: Re: Considering Attribute Subtypes during ACL evaluation

One possible precedence:
        type;a;b;c
        type
        supertype;a;b;c
        supertype

I prefer this.

Kurt

---

From: "Volpers, Helmut" <[email-masked]>
Date: Thu, 5 Oct 2000 18:04:24 +0200

Hi Jim,
 
X.500 says for opinion nothing about AccessControl and subtyping. Access
Control can be given on an
attribute basis and have nothing to do with the subtyping of attributes.
Subtypes are defined in the schema and are only used in the search, if you
give a supertype in a filter item all subtypes will be searched also.
 
Helmut

-----Original Message-----
From: Jim Sermersheim [mailto:[email-masked]]
Sent: Dienstag, 3. Oktober 2000 00:40
To: [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: Considering Attribute Subtypes during ACL evaluation

I agree for the exact same reason optional support of attr subtyping). It
would also be interesting to hear from the X.500 community on how this is
handled by different vendors. I found the whole thing unspecified.
 
Jim

>>> "Kurt D. Zeilenga" <[email-masked]> 9/30/00 12:59:03 PM >>>

Kurt

---

From: "Volpers, Helmut" <[email-masked]>
Date: Mon, 9 Oct 2000 09:13:00 +0200

I agree with Steven

Helmut

> From: Steven Legg [mailto:[email-masked]]
> Sent: Montag, 9. Oktober 2000 01:16
> To: 'Jim Sermersheim'
> Cc: [email-masked]
> I can't find anything in X.500 that clarifies whether 
> attribute subtyping
> applies when evaluating access controls. Our implementation ignores
> subtyping when making access control decisions. It seems the safer
> choice.
> 
> Regards,
> Steven
> 
> Sent: Tuesday, 3 October 2000 9:40

---

From: "Jim Sermersheim" <[email-masked]>
Date: Mon, 09 Oct 2000 11:32:51 -0600

Also, RFC 2256, Section 5.42 says:
"... LDAP server implementations which do not support attribute subtyping ... Client Implementations MUST NOT assume that LDAP servers are capable of performing attribute subtyping."

>>> "Kurt D. Zeilenga" <[email-masked]> 10/6/00 5:17:32 PM >>>
At 03:00 PM 10/6/00 -0700, sanjay jain wrote:

>"Kurt D. Zeilenga" wrote:
>
>[snip]
>
>> However, given that subtyping is optional in LDAPv3,
>
>Kurt
>   Could you please point to the text in RFC 2251 (or
>   any other LDAP RFC) which explicitly states that
>   subtyping is optional in LDAPv3.  I just want to confirm.

I believe it's implicit in the following statements:

3.2.2:
   Servers which follow X.500(93) models SHOULD implement subschema
   using the X.500 subschema mechanisms, and so these subschemas are not
   ordinary entries.  LDAP clients SHOULD NOT assume that servers
   implement any of the other aspects of X.500 subschema.

The first sentence implies that servers may not follow X.500(93).

3.3:
   LDAP can be mapped onto any
   other directory system so long as the X.500 data and service model as
   used in LDAP is not violated in the LDAP interface.

The interface is not violated if subtyping is not supported.