Subject: Adding to the LDAP ACM to a WG charter

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 15 Nov 2001 16:55:57 -0800

This message is intended to clarify the reasons why I
oppose having LDAP ACM work item on any IETF WG charter
at this time.

Many (most?) of us (including I) would like very much
to see LDAP have a Standard Track powerful, flexible,
and extensible standard track access control model. 
Many of us have tried very hard to produce such.  But
after years of trying, it became clear that the IETF
was not going to reach consensus on a number of critical
issues.  The issues are the same, the people are (mostly)
the same, a change of venue (LDAPext->LDUP) won't help.

But a change to which process used may help.  Those who
support an LDAPext-ACM based solution should, as individuals,
produce the best damn LDAP ACM specification they can and
those who support alternative approaches should, as
individuals, produce the best damn specification they can.
We should give each set of individuals a reasonable amount
of time to produces these specifications.   Then, based upon
what is produced by the sets of individuals, determine how
best to proceed:
	a) adopt one (publish on Standard Track)
	b) adopt none
	c) create a WG to take one approach to Standard Track

Based upon discussions I had at IETF#51 and with individuals
since then, I believe we will soon multiple pretty damn good
alternatives submitted (post IETF#52).

IMO, we'll have an LDAP ACM must sooner than later if LDUP
stays out of way.

Kurt

---

From: "Chris Apple" <[email-masked]>
Date: Fri, 16 Nov 2001 08:00:20 -0500

Thanks. So far, you are the only LDUP WG member
to raise such concerns. Which means that concensus
is currently leaning towards adding LDAP ACM to the
LDUP WG charter. That is clear by looking at the
postings on the topic in the mailing list archives.

However, I am still on the hook to post another
charter revision that includes LDAP ACM as a tool
to gauge WG concensus on the matter based on a
concrete proposal for deliverables.

As you know, WG concensus is what must be reflected
by John and I to the ADs and the IESG when it comes
to charter scoping, deliverables to be produced,
and additional work items.

So far, we only have a general concensus that the
ACM work should be added to the LDUP WG Charter.
If we are unable to achieve WG concensus on the
details of how to add it, it would of course not
be adopted.

All of the above would be subject to AD and IESG approval...

Which means that even if the WG believes it should do something,
it could be told "not so" by the IESG or the ADs.

Chris Apple

Who has finally figured out that life is mostly and rightfully
about wondering what to fix for dinner.

>From: "Kurt D. Zeilenga" <[email-masked]>
>To: "Chris Apple" <[email-masked]>
>CC: [email-masked]
>Subject: Re: Adding to the LDAP ACM to a WG charter
>Date: Thu, 15 Nov 2001 21:02:44 -0800
>
>At 05:59 PM 2001-11-15, Chris Apple wrote:
> >1) You are asserting that the IETF process won't
> >  work for LDAP ACM and would need to be modified
> >  slightly to result in the production of a good
> >  LDAP ACM specification.
>
>I see no need to change IETF process [RFC 2026] or
>WG guidelines [RFC 2418] and am not advocating such.
>The IETF process and guidelines are flexible.  The
>process considers both working group and individual
>efforts in producing RFCs.
>
>Presently, I believe that LDAP ACM standardization
>work is best pursued on an individual basis.
>
> >2) You are advocating that this process modification
> >  would be that multiple proposals for an LDAP ACM
> >  should be written outside of the context of any WG.
>
>I am suggesting that we let individuals pursue this work
>under the established process.
>
> >3) You are expecting one of these proposals to become
> >  vetted in some way to become the eventual product
> >  of a WG other than LDUP.
>
>I am hoping that one or more proposals of appropriate quality,
>drafted by individuals, would be submitted for consideration
>for publication.  As with any other submission to the IETF,
>the IETF would review these works and take appropriate action.
>
>My assertions apply equally to LDUP as to any WG which might
>consider taking on LDAP ACM work (or be formed specifically
>for this work).  Any reference I made to LDUP was solely due
>to the fact it happens to be the WG considering taking on
>LDAP ACM work.  I don't think changing the WG venue matters
>much (as the interested parties follow the work).
>
> >4) You are asserting that the LDUP WG will either produce an
> >  inferior or at least a delayed LDAP ACM than a different
> >  WG with the same members would be able to.
>
>I believe any WG taking on LDAP ACM work will be stalled due
>to lack of consensus.  Individuals, not subject to WG
>consensus, can produce an LDAP ACM for consideration by the
>IETF much faster.
>
>Of course, any LDAP ACM I-D submitted for consideration on
>the Standard Track, whether produced by a WG or individuals,
>has IETF consensus requirements.
>
>And, in terms of meeting overall desires (powerful, flexible,
>extensible, etc.), I think individuals can do better than
>a WG in this case.  LDAPext had to remove functionality to
>remove contention.  Individuals generally don't have to do
>that.
>
>Anybody remember the SGMP/CMOT wars which resulted in SNMP?
>Basically I am suggesting a similar approach.  That is, let
>each set of individuals develop the very best specification
>they can, make "where's the ACM?" buttons ;-) and then
>consider how to proceed.
>
>Kurt
>
> >>From: "Kurt D. Zeilenga" <[email-masked]>
> >>To: [email-masked]
> >>Subject: Adding to the LDAP ACM to a WG charter
> >>Date: Thu, 15 Nov 2001 16:55:57 -0800
> >>
> >>
> >_________________________________________________________________
> >Get your FREE download of MSN Explorer at 
>http://explorer.msn.com/intl.asp
>

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

---

From: "Paul Leach" <[email-masked]>
Date: Fri, 16 Nov 2001 16:46:18 -0800

> -----Original Message-----
> From: Richard V Huber [mailto:[email-masked]] 
> Sent: Friday, November 16, 2001 3:59 PM
> To: [email-masked]; [email-masked]; Paul Leach
> Cc: [email-masked]

> 
> Since LDAPEXT is shutting down, the ACM work needs a new 
> home.  Since most of the members of LDAPEXT are also part of 
> LDUP, and since the ACM work is needed for LDUP, LDUP seems 
> like the right place to do it.
> 
> Access control is a complicated topic.  I think it needs the 
> benefit of the technical review a WG will provide.

The last paragraph at most argues for _some_ WG, but not necessarily
this one.

As Kurt has noted, the previous paragraph says that the same gang who
couldn't get an ACM done in LDAPEXT are just as likely to not get it
done in LDUP, and in the meantime, the focus on replication is vitiated.

I vote for starting another WG on ACM, or letting individuals do it. And
note that WGs can technically review things even if individuals propose
them.

Paul

---

From: "Ed Reed" <[email-masked]>
Date: Mon, 19 Nov 2001 11:17:25 -0700

I didn't quite follow that, Ellen - "since this work cannot be finished
in LDUP (ldapext is shutting down)" seems like a non-sequitor.  Did
you mean it can't be done in LDAPEXT?

I come down in favor of a separate working group to hash out
the end-all-and-be-all Access Control Model, or even an appropriate
subset.  

In addition to the list of issues that Kurt raised, I'll point
out that the X.500 model also includes provisions for Rule Based
Access Control, which takes determination of appropriate 
security clearances, roles, etc. to be more important than the
actual identity of the security principal, which is a particularly
important manner of access control among very large, independently
administered heterogeneous communities like the Internet.

The X.500 work was, I think, done to address data handling
constraints associated with the US DOD Defence Messaging System
design, which is not getting much press today.

However, the notion that interoperability between companies
should follow a model that allows data administrators in the directory
to set classification of data that requires role and clearance
information to be authoritatively provided, without necessarily
having any knowledge at all about the actual identity of the
principal (anonymous, but trusted, vs anonymous and untrusted)
is very attractive.

Kurt's list of Authentication issues to discuss, together with the
X.500 notion of Rule Based Authorization and the current market
craze in favor of Role Based Authentication (where the ACI
refers to a role, not an individual, and it's the job of the
authentication service to provide information about the roles
and clearance of the principal to relying services like the directory)
should NOT be dealt with in LDUP, but rather a separate
LDAPACM working group.

The (proposed new) LDAPACM working group should work diligently
to (a) not break LDAP, (b) store its policy and principal information
in the Directory so that LDUP will replicate it, and detail as much
as possible what special provisions, if any, are needed in LDUP to
preserve the integrity of the ACM information.  For instance, 
it might very well be a requirement that ACM information
be sent by state-based replication schemes in LDUP BEFORE any
of the data elements to which it applies is sent.

I vote in favor of NOT doing LDAPACM in LDUP, but rather
leaving LDUP to the task of shipping directory information around
"safely", while leaving LDAPACM the opportunity to place
SOME requirements on LDUP when those requirements are fully 
known.

LDUP is useful (as was LDAPv2 and LDAPv3) even if it does not provide
a complete, seamless, end-to-end, multi-vendor environment with
a perfectly consistent management and security policy implementation.

Lets get on with discovering what some of those uses are.

Ed

=================
Ed Reed
Reed-Matthews, Inc.
+1 585 624 2402
http://www.Reed-Matthews.COM
Note:  Area code is 585

>>> Ellen Stokes <[email-masked]> 11/17/01 12:40PM >>>

Security is important for a replicated environment.

For the secure replicated heterogeneous environment to work, an
access control model is necessary.

Since this work cannot be finished in LDUP (ldapext is shutting
down), the access control model needs a home.

And given the complexity of the topic, it is insufficient to just
release the spec as informational, experimental, or as an
individual publication.

I am FOR adding access control model to LDUP.

Ellen

---

From: "Paul Leach" <[email-masked]>
Date: Mon, 19 Nov 2001 13:18:26 -0800

> From: Ryan Moats [mailto:[email-masked]] 
> Sent: Monday, November 19, 2001 11:25 AM
> To: Steven Legg

> Pardon? I thought the idea of LDUP was a standard that would 
> lead to interoperability.  I don't see how this is possible 
> if deployment is ignored.

I believe that a quite useful replicated directory could be deployed
with limited security functionality until an ACM standard is completed. 

How, you ask? As someone else noted, the access policy could be kept in
synch out of band. In practice, that would mean access policy would have
to be simple, and change infrequently. A very useful, and quite
depoyable, policy that meets that requirement is one that allows
everyone read, and one person or group update, to the contents of the
whole server (or whole naming contexts within the server, if you want to
get slightly more complex).

Paul

---

From: Ellen Stokes <[email-masked]>
Date: Mon, 19 Nov 2001 18:23:34 -0600

The non-sequitor you point to is a typo on my part.
I meant to say that the ACM work cannot be finished in LDAPext
because that group is shutting down.
Ellen

---

From: "Roddy A. Sue" <[email-masked]>
Date: Tue, 20 Nov 2001 07:03:35 -0500

As someone who needs to deploy a global directory that contains white, blue
and yellow pages data, as well as key management data, I am not in an
operational environment that permits one group or person to manage all the
data.

My accountability and separation of duty requirements on the administrators
of this system lead us to more than simplistic access control models.
Replication of that data to any portion of the system, as well as a
standardized process for performing the access control decision function is
very high on the requirements list.  

We are hampered in our ability to select different products for our
directory services by the lack of a standardized approach.  The initial
rollout/deployment will be product-specific because the interoperability
cannot be tested or specified in procurement documents, since it does not
exist in a standardized way.

To be fair, we are also hampered by a standardized means of deriving the
ownership rules of the data and I would like to see some additional work
done on development of that kind of framework.  I believe the OpenGroup has
expressed interest in helping establish the framework. However, without a
standardized means of replicated the AC information, we cannot progress
beyond a homogenous directory server environment.

regards

Sandi Roddy
National Security Agency
V5 Technical Director - Security
410-854-7070

-----Original Message-----
From: Paul Leach [mailto:[email-masked]]
Sent: Monday, November 19, 2001 4:18 PM
To: Ryan Moats; Steven Legg
Cc: [email-masked]
Subject: RE: Adding to the LDAP ACM to a WG charter

Paul

---

From: "Paul Leach" <[email-masked]>
Date: Tue, 20 Nov 2001 10:08:10 -0800

I want to be clear. I am not suggesting that, in order to allow
multi-vendor replicas, a standard ACM isn't required.

The only question is whether they need to be developed by the same WG,
other whether _this_ WG should focus on what has proven to be a very
difficult problem, and finish it; or whether it should undertake another
very difficult problem that may very well defocus it and delay finishing
the primary one it was set up to solve.

This is not a question of requirements -- it is a question of creating
an efficient engineering process to get things done. I believe that
history has shown conclusively that trying to solve too many hard
problems simultaneously leads to none of them getting done.

Paul

---

From: "Roddy A. Sue" <[email-masked]>
Date: Tue, 20 Nov 2001 13:10:35 -0500

Is there any effort in a security-focused working group to look at
cross-protocol security attribute definitions?  One would like to think that
a common solution could be found (separate from the bio-diversity argument
of security through obscurity).

Sandi Roddy
National Security Agency

-----Original Message-----
From: Paul Leach [mailto:[email-masked]]
Sent: Tuesday, November 20, 2001 1:08 PM
To: Roddy A. Sue; Ryan Moats; Steven Legg
Cc: [email-masked]
Subject: RE: Adding to the LDAP ACM to a WG charter

Paul

---

From: "Bruce Greenblatt" <[email-masked]>
Date: Wed, 21 Nov 2001 10:55:09 -0800

I guess that if the message had included a subject, that would have been
helpful...

> From: Bruce Greenblatt 
> Sent: Wednesday, November 21, 2001 10:01 AM
> To: [email-masked]
> Subject: 
> 
> 
> Paul Leach wrote...
> 
> I'm arguably a little late into the thread.  I mostly agree 
> with Paul, except that I would like to see it done as a BOF.  
> If the work can't be completed in the next two meetings, then 
> there isn't much point. If the current model is pretty much 
> on target, then it should only take a little more work.  If 
> the current model is way off target, then it will never get 
> finished.  So, I would prefer that LDAP ACM not be added to 
> LDUP, and instead it should be considered by a separate WG or 
> BOF session.
> 
> Bruce
> 
>  
>  
>