Subject: RE: moving access control discussion to LDUP

From: "Matt Hirsch" <[email-masked]>
Date: Thu, 15 Nov 2001 10:41:52 -0500

Hi all,

Typing on a government machine, I agree with Chris Apple.  We need to
continue development of the AC draft.  In my mind this document should
serve as the foundation for establishing security in managing,
controlling access to, and replicating information in the LDAP world.
It is obvious that LDAP is the directory access protocol of choice (at
least today and most likely for the next few years).  The Government, in
it's continuing drive to remain vendor independent and in compliance
with commercial standards, is extremely interested in continuing to
develop the Access Control LDAP standards and will most likely be able
to contribute to the furtherance of this early next year with the award
of a rather large contract that is geared towards standards development.

My vote (speaking for the NSA V51) is that we continue to develop the
Access Control Model for LDAP V3 in either the LDUP WG or in a revived
LDAP EXT WG tiger team and finish the draft to a RFC state.  At this
point, it could be turned over to the LDUP WG.

Regards,
Matt Hirsch

A&N Associates Inc.
Management & Technology Consulting
410-772-5060 ext 22 

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Wednesday, November 14, 2001 6:15 PM
To: [email-masked]
Cc: Christopher Apple; 'Rob Byrne - Sun Microsystems'; Mark Wahl;
[email-masked]; [email-masked]
Subject: RE: moving access control discussion to LDUP

At 02:05 PM 2001-11-14, John Strassner wrote:
>So how will the protocol be able to interoperate without a common ACM?

At the level of interoperability this WG is attempting to achieve,
it cannot.  But then, this WG will needs much more than a common
ACM to provide the level of interoperability it is attempting to
achieve.

IMO, the WG as bitten off more that it can chew and bitting off
more will only cause the WG to choke.

So, I wonder, what is beyond scope of this working group?

Kurt

---

From: "Paul Leach" <[email-masked]>
Date: Thu, 15 Nov 2001 12:05:40 -0800

It could interop assuming that all data was public read-write, or public
read on all but one of the servers, with that one controlling who could
update (i.e., master-slave).

Taking this approach would let you factor the problems -- you could
focus on the replication issues, and when some future WG came up with a
common access control syntax and semantics, then it would just plug in.

> From: John Strassner [mailto:[email-masked]]
> Sent: Wednesday, November 14, 2001 2:06 PM
> To: Kurt D. Zeilenga; Christopher Apple
> Cc: 'Rob Byrne - Sun Microsystems'; Mark Wahl; 
> thanks,
> John
> Sent: Wednesday, November 14, 2001 2:53 PM
> To: Christopher Apple
> Cc: 'Rob Byrne - Sun Microsystems'; Mark Wahl;
> [email-masked]; [email-masked]; [email-masked]
> Please note that I feel the LDUP WG should not undertake
> the LDAP ACM work or any other new work.  The LDUP WG
> needs to narrow its focus and trim its workload if it
> is ever to successfully conclude.
> 
> And also I ask that the charter be clarified as to the
> extent of work this WG is undertaking (or intends to
> undertake).  In particular, the charter should state whether 
> or not the group intends to:
> 	1) Update LDAPv3 "core" specification (including
> 	   its normative references),
> 	2) Define an ACM for LDAPv3, and/or
> 	3) Define an authentication identity to
> 	   authorization identity mapping scheme.
> 
> (Note that the mapping scheme is needed for an ACM
> to provide any reasonable level of consistent access
> to client entities in a replicated environment.)
> 
> Kurt
> 
>

---

From: <[email-masked]>
Date: Thu, 15 Nov 2001 16:22:11 -0500

When it comes to interoprability, I think that AC has higher priority than
Replication because
most companies who implement directory replication may end up using the
same vendor product.

I would like to see AC work to be continued.
It seems that completing development of replication requires AC. Sounds
that it is natural for LDUP to take over.
I vote for moving it to LDUP.

-Christine Yoon
PricewaterhouseCoopers

"Kurt D. Zeilenga" <[email-masked]>@mail.imc.org on 11/14/2001 06:14:30
PM

Sent by:  [email-masked]

To:   [email-masked]
cc:   Christopher Apple <[email-masked]>, 'Rob Byrne
      - Sun Microsystems' <[email-masked]>, Mark Wahl
      <[email-masked]>, [email-masked], [email-masked]
Subject:  RE: moving access control discussion to LDUP

Kurt

----------------------------------------------------------------
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material.  Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.   If you received
this in error, please contact the sender and delete the material from any
computer.

---

From: "Paul Leach" <[email-masked]>
Date: Thu, 15 Nov 2001 15:36:04 -0800

> From: [email-masked] 
> [mailto:[email-masked]] 
> Sent: Thursday, November 15, 2001 1:22 PM
> To: [email-masked]
> Cc: [email-masked]; Christopher Apple; 'Rob 
> Byrne - Sun Microsystems'; Mark Wahl; [email-masked]
> When it comes to interoprability, I think that AC has higher 
> priority than Replication because most companies who 
> implement directory replication may end up using the same 
> vendor product.

If that's true, then there is no need for LDUP (i.e., standards based
replication) at all -- the vendor can use any old proprietary
replication protocol, and interoperability from the clients will not be
affected.

This WG _was_ about standards based replication, and not about access
control. (I understand that the charter is open for revision, so it's
fair game now.)

Once there is a replication standard, and some other WG creates a access
control standard, then we'll be able to replicate it. Until then, absent
such a standard, replication would be confined to special cases.
However, ignoring the access control issue will let us make progress on
replication, which what this WG was started to do -- I would suggest we
focus on that.

The problems are factorable, and problems that get factored get solved
quicker.

Paul