Subject: RE: Adding to the LDAP ACM to a WG charter

From: "Ryan Moats" <[email-masked]>
Date: 17 Nov 2001 13:55:48 -0000

On Fri, 16 Nov 2001 16:46:18 -0800, "Paul Leach"
<[email-masked]> wrote :

> > -----Original Message-----
> > From: Richard V Huber [mailto:[email-masked]] 
> > 
> > Since LDAPEXT is shutting down, the ACM work needs a new 
> > home.  Since most of the members of LDAPEXT are also part of 
> > LDUP, and since the ACM work is needed for LDUP, LDUP seems 
> > like the right place to do it.
> > 
> > Access control is a complicated topic.  I think it needs the 
> > benefit of the technical review a WG will provide.
> 
> The last paragraph at most argues for _some_ WG, but not necessarily
> this one.

This begs the question "does LDUP need an ACM?"

Now I think so, because I see that without an ACM, most of the useful (to
me)
LDUP topic are gutted.

I should think that folks who are saying that LDUP should not take on ACM
should
be providing at least some thought on what LDUP can accomplish without it.

> As Kurt has noted, the previous paragraph says that the same gang who
> couldn't get an ACM done in LDAPEXT are just as likely to not get it
> done in LDUP, and in the meantime, the focus on replication is vitiated.

Ok, as a thought experiment, let's posit a new "ldapacm" wg.  Why wouldn't
this
group have the same players?  Why wouldn't it have the same problems?
I would think creating a new wg would just create more overhead and further
slow
LDUP because it would need to wait for this other WG.

Ryan

---

From: Ellen Stokes <[email-masked]>
Date: Sat, 17 Nov 2001 11:40:58 -0600

Security is important for a replicated environment.

For the secure replicated heterogeneous environment to work, an
access control model is necessary.

Since this work cannot be finished in LDUP (ldapext is shutting
down), the access control model needs a home.

And given the complexity of the topic, it is insufficient to just
release the spec as informational, experimental, or as an
individual publication.

I am FOR adding access control model to LDUP.

Ellen

---

From: "Steven Legg" <[email-masked]>
Date: Mon, 19 Nov 2001 11:02:30 +1100

> This begs the question "does LDUP need an ACM?"

No. While it is true that replicating a secure environment requires that
the participating servers have the ability to support a common ACM, the
LDUP architecture, protocol, URP, etc have no dependence on the actual
details of the ACM(s) being used. We can complete the LDUP work without
defining an ACM. Deployment is a separate issue.

> be providing at least some thought on what LDUP can 

I observe that X.500 vendors already have a common access control model
that can be replicated through DISP. It would be replicated equally well
through LDUP.

> group have the same players?  Why wouldn't it have the same problems?

It would have the same problems, but at least they wouldn't belong to
the LDUP working group.

> LDUP because it would need to wait for this other WG.

LDUP wouldn't need to wait for this other WG, the details of the ACM
don't matter to the LDUP specifications.

I don't think the ACM should be added to LDUP charter. The LDUP
specifications don't need it and the LDUP WG can do without the
distraction.

Regards,
Steven

---

From: Ryan Moats <[email-masked]>
Date: Mon, 19 Nov 2001 13:25:18 -0600

On Mon, Nov 19, 2001 at 11:02:30AM +1100, Steven Legg wrote:
| 
| Ryan Moats wrote:
| > On Fri, 16 Nov 2001 16:46:18 -0800, "Paul Leach"
| > <[email-masked]> wrote :
| > 
| > > > -----Original Message-----
| > > > From: Richard V Huber [mailto:[email-masked]] 
| > > > 
| > > > Since LDAPEXT is shutting down, the ACM work needs a new 
| > > > home.  Since most of the members of LDAPEXT are also part of 
| > > > LDUP, and since the ACM work is needed for LDUP, LDUP seems 
| > > > like the right place to do it.
| > > > 
| > > > Access control is a complicated topic.  I think it needs the 
| > > > benefit of the technical review a WG will provide.
| > > 
| > > The last paragraph at most argues for _some_ WG, but not necessarily
| > > this one.
| > 
| > This begs the question "does LDUP need an ACM?"
| 
| No. While it is true that replicating a secure environment requires that
| the participating servers have the ability to support a common ACM, the
| LDUP architecture, protocol, URP, etc have no dependence on the actual
| details of the ACM(s) being used. We can complete the LDUP work without
| defining an ACM. Deployment is a separate issue.

Pardon? I thought the idea of LDUP was a standard that would lead to
interoperability.  I don't see how this is possible if deployment is
ignored.

Ryan