Subject: RE: moving access control discussion to LDUP

From: Christopher Apple <[email-masked]>
Date: Wed, 14 Nov 2001 11:30:12 -0500

Neither John nor I are wed to the idea of keeping the ACM document
in exactly its present form.

What the WG has clearly achieved consensus on (several times and
each time the issue has been raised) is that without some baseline
ACM for LDAP, LDUP has little chance of being inteoperable (at least
not in a secure way) across implementations from multiple vendors.

Some of the more active WG members have explicitly requested that
the LDUP co-chairs consider moving the work from LDAPEXT to LDUP
as LDAPEXT is closing down and concensus has not been reached on
the ACM document's content.

It may be that we have to specify in LDUP the minimum required
ACM for LDUP to work as expected. We're just proposing that the
current document be used as a starting point for discussion within
the LDUP WG.

Chris Apple
Program Manager - Integration Services
United Messaging Inc.
<http://www.unitedmessaging.com>
<mailto:[email-masked]> 
(V) +1 610 425 2860

-----Original Message-----
From: Rob Byrne - Sun Microsystems [mailto:[email-masked]]
Sent: Wednesday, November 14, 2001 4:31 AM
To: Mark Wahl
Cc: [email-masked];
[email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: Re: moving access control discussion to LDUP

All,

My own (vendor-centric) opinion on the progreess of the acl draft, is
that,
unfortunately, in LDAP life-time terms it is very (if not, too) late to
successfully progress this to a standard.

I would categorize the main problem as "entrenched vendors".  Seems like
everyone agrees in principle that standard access control would be a
good idea
but when it comes to the crunch vendors are reluctant to reinvest in
developing
a new access control system in their servers.  So it seems the best we
could do
would be to preserve the work (some of which may still be useful to
vendors
polishing their  implementations) by moving it to the experimental or
informational category.

I think there may also be scope for pulling some of the sections out and
submitting them as independent ID's; for example the getEffectiveRights
section
could probably be expressed in sufficiently general terms that any
vendor could
support it.

Perhaps the best opportunity  for  standard directory access acontrol
will occur
as/if directories evolve to integrate more with the XML world.  The XML
guys are
currently recasting the wheel in XML terms and for example the XACML
work stands
a chance of success as they don't have the entrenched vendor problem.

I would advise the LDUP chairs to poll the LDUP group and ensure that
there is
enough (preferably more than enough!) support for completing the acl
draft in
LDUP, before adopting it.

Rob.

Mark Wahl wrote:

> It may be worthwhile to consider adding the access control
standardization
> discussion to LDUP, as LDUP will need the replication of access
control
> information for many of its scenarios.  This activity was ongoing in
LDAPEXT,
> but LDAPEXT is shutting down and has not reached rough consensus on
> access control specification.
>
> Mark Wahl
> Sun Microsystems Inc.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 14 Nov 2001 13:53:14 -0800

Please note that I feel the LDUP WG should not undertake
the LDAP ACM work or any other new work.  The LDUP WG
needs to narrow its focus and trim its workload if it
is ever to successfully conclude.

And also I ask that the charter be clarified as to the
extent of work this WG is undertaking (or intends to
undertake).  In particular, the charter should state
whether or not the group intends to:
	1) Update LDAPv3 "core" specification (including
	   its normative references),
	2) Define an ACM for LDAPv3, and/or
	3) Define an authentication identity to
	   authorization identity mapping scheme.

(Note that the mapping scheme is needed for an ACM
to provide any reasonable level of consistent access
to client entities in a replicated environment.)

Kurt

---

From: "John Strassner" <[email-masked]>
Date: Wed, 14 Nov 2001 15:05:39 -0700

So how will the protocol be able to interoperate without a common ACM?

thanks,
John

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Wednesday, November 14, 2001 2:53 PM
To: Christopher Apple
Cc: 'Rob Byrne - Sun Microsystems'; Mark Wahl;
[email-masked]; [email-masked]; [email-masked]
Subject: RE: moving access control discussion to LDUP

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 14 Nov 2001 15:14:30 -0800

>So how will the protocol be able to interoperate without a common ACM?

At the level of interoperability this WG is attempting to achieve,
it cannot.  But then, this WG will needs much more than a common
ACM to provide the level of interoperability it is attempting to
achieve.

IMO, the WG as bitten off more that it can chew and bitting off
more will only cause the WG to choke.

So, I wonder, what is beyond scope of this working group?

Kurt