Subject: Re: revised WG charter proposal

From: "Timothy Hahn" <[email-masked]>
Date: Mon, 19 Nov 2001 09:40:32 -0500

Hello,

Excerpt from Proposed WG charter:

o LDAPv3 Access Control Issues

   Replication using heterogeneous LDAPv3 servers is dependent on
   resolving LDAPv3 access control issues, which are currently in
   the domain of another Applications Area working group. RFC 2820,
   Access Control Requirements for LDAP, was produced by that working
   group. However, this working group has elected to close prior to
   establishing consensus on other documents, such as an Access Control
   Model specification for LDAPv3. Such documents are necessary for
   LDUP to meet certain replication requirements documented by the
   LDUP WG. Thus, the remaining access control work and the latest
   revision of the access control model Internet Draft produced by
   the originating working group as starting point for continuing
   the work in the LDUP WG.

My opinion on whether the workgroup should solve the access control model 
specification is as follows:

a) in order for replication to take place and ensure that data replicated 
in two different server instances is not accessed inappropriately in 
either one of the server instances, the replication model MUST rely on 
some statement about access control.  I would expect that these statements 
would be covered in the "Security Considerations" section of the drafts 
and RFCs (among other places).
b) the past attempts by LDAPext to establish consensus around any 
particular access control model have not been successful.  Progress has 
been made, to be sure, but in my opinion, we are not yet near a "final 
solution" with consensus.
c) I do not believe that LDUP requires a FULL access control model 
specification in order to proceed with a "secure" solution.  By this, I 
believe that the two problems ARE factorable.
d) There are elements of the current access control model specification 
that could help us "factor" the problems - namely the notion in the 
current ACM model that each ACI is defined by some OID and the particular 
ACI(s) that a server supports/uses is held in the root DSE.

I feel that the LDUP WG SHOULD pursue a specification of how access 
control "frameworks" are published (without specifying/defining any 
particular access control model design).  This allows for two (or n) 
servers to establish what access control models are defined/implemented on 
any particular server and for those servers to figure out IF they can 
"agree" on a ACI model to use.

With this "framework" agreed upon, LDUP can state in its "security 
considerations" that for secure environments, replicating servers MUST 
implement and use "compatible" ACI models - but LDUP need NOT define any 
particular model be employed.  I believe that this allows the access 
control to be "factored" from the replication problem.

In summary, I feel that LDUP should NOT take on the "whole" access control 
problem (as is attempted in the current ACM draft from the LDAPext working 
group).  Rather, LDUP should take on work to define a "framework" in which 
different ACI models can be defined and published, and then LDUP should 
state that "compatible" access control models MUST be used for secure 
replication.

Regards,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Endicott/IBM@IBMUS or IBMUSM00(HAHNT)
phone: 607.752.6388     tie-line: 8/852.6388
fax: 607.752.3681

---

From: "Ed Owens" <[email-masked]>
Date: Mon, 19 Nov 2001 09:20:13 -0800

Tim,
    Thank you for your "factoring" discussion.  While I am opposed to bringing all of the ACM work into the LDUP working group I believe that your suggestion, including sufficient information for publishing access control frameworks but not defining any particular model, is a good compromise that allows LDUP to have some chance of completion without getting bogged down in the seemingly interminable discussion around access control.  I would support changes to the LDUP charter that specified this task.  What I cannot support is the current wording of the charter which moves all of the access control discussion into the LDUP WG which I maintain (with others) will only slow to a crawl any meaningful work on the original goals of LDAP replication.

        Ed Owens

Edward Owens
Principal Consultant
Noetic Solutions LLC
(925)366-1005
[email-masked]
http://www.noetic.net
  ----- Original Message ----- 
  From: Timothy Hahn 
  To: Ietf-Ldup@Imc. Org 
  Sent: Monday, November 19, 2001 6:40 AM
  Subject: Re: revised WG charter proposal

  Hello, 

  My opinion on whether the workgroup should solve the access control model specification is as follows: 

  a) in order for replication to take place and ensure that data replicated in two different server instances is not accessed inappropriately in either one of the server instances, the replication model MUST rely on some statement about access control.  I would expect that these statements would be covered in the "Security Considerations" section of the drafts and RFCs (among other places). 
  b) the past attempts by LDAPext to establish consensus around any particular access control model have not been successful.  Progress has been made, to be sure, but in my opinion, we are not yet near a "final solution" with consensus. 
  c) I do not believe that LDUP requires a FULL access control model specification in order to proceed with a "secure" solution.  By this, I believe that the two problems ARE factorable. 
  d) There are elements of the current access control model specification that could help us "factor" the problems - namely the notion in the current ACM model that each ACI is defined by some OID and the particular ACI(s) that a server supports/uses is held in the root DSE. 

  I feel that the LDUP WG SHOULD pursue a specification of how access control "frameworks" are published (without specifying/defining any particular access control model design).  This allows for two (or n) servers to establish what access control models are defined/implemented on any particular server and for those servers to figure out IF they can "agree" on a ACI model to use. 

  With this "framework" agreed upon, LDUP can state in its "security considerations" that for secure environments, replicating servers MUST implement and use "compatible" ACI models - but LDUP need NOT define any particular model be employed.  I believe that this allows the access control to be "factored" from the replication problem. 

  In summary, I feel that LDUP should NOT take on the "whole" access control problem (as is attempted in the current ACM draft from the LDAPext working group).  Rather, LDUP should take on work to define a "framework" in which different ACI models can be defined and published, and then LDUP should state that "compatible" access control models MUST be used for secure replication. 

  Regards,
  Tim Hahn