Subject: Re: Adding to the LDAP ACM to a WG charter

From: "Chris Apple" <[email-masked]>
Date: Thu, 15 Nov 2001 20:59:31 -0500

There seem to be a few major points that you
are making below - I'm trying to distill what
you wrote to a few distinct and clear bullets.
Please correct any errors of interpretation I've
made or add to the list as appropriate. No judgement
at all implied here, I'm just trying to understand
the points you are making clearly so that we can
discuss them in a productive way.

1) You are asserting that the IETF process won't
   work for LDAP ACM and would need to be modified
   slightly to result in the production of a good
   LDAP ACM specification.

2) You are advocating that this process modification
   would be that multiple proposals for an LDAP ACM
   should be written outside of the context of any WG.

3) You are expecting one of these proposals to become
   vetted in some way to become the eventual product
   of a WG other than LDUP.

4) You are asserting that the LDUP WG will either produce an
   inferior or at least a delayed LDAP ACM than a different
   WG with the same members would be able to.

Chris.

>From: "Kurt D. Zeilenga" <[email-masked]>
>To: [email-masked]
>Subject: Adding to the LDAP ACM to a WG charter
>Date: Thu, 15 Nov 2001 16:55:57 -0800
>
>
>This message is intended to clarify the reasons why I
>oppose having LDAP ACM work item on any IETF WG charter
>at this time.
>
>Many (most?) of us (including I) would like very much
>to see LDAP have a Standard Track powerful, flexible,
>and extensible standard track access control model.
>Many of us have tried very hard to produce such.  But
>after years of trying, it became clear that the IETF
>was not going to reach consensus on a number of critical
>issues.  The issues are the same, the people are (mostly)
>the same, a change of venue (LDAPext->LDUP) won't help.
>
>But a change to which process used may help.  Those who
>support an LDAPext-ACM based solution should, as individuals,
>produce the best damn LDAP ACM specification they can and
>those who support alternative approaches should, as
>individuals, produce the best damn specification they can.
>We should give each set of individuals a reasonable amount
>of time to produces these specifications.   Then, based upon
>what is produced by the sets of individuals, determine how
>best to proceed:
>	a) adopt one (publish on Standard Track)
>	b) adopt none
>	c) create a WG to take one approach to Standard Track
>
>Based upon discussions I had at IETF#51 and with individuals
>since then, I believe we will soon multiple pretty damn good
>alternatives submitted (post IETF#52).
>
>IMO, we'll have an LDAP ACM must sooner than later if LDUP
>stays out of way.
>
>Kurt
>
>

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 15 Nov 2001 21:02:44 -0800

>  slightly to result in the production of a good

I see no need to change IETF process [RFC 2026] or
WG guidelines [RFC 2418] and am not advocating such.
The IETF process and guidelines are flexible.  The
process considers both working group and individual
efforts in producing RFCs.

Presently, I believe that LDAP ACM standardization
work is best pursued on an individual basis.

>  should be written outside of the context of any WG.

I am suggesting that we let individuals pursue this work
under the established process.

>  vetted in some way to become the eventual product

I am hoping that one or more proposals of appropriate quality,
drafted by individuals, would be submitted for consideration
for publication.  As with any other submission to the IETF,
the IETF would review these works and take appropriate action.

My assertions apply equally to LDUP as to any WG which might
consider taking on LDAP ACM work (or be formed specifically
for this work).  Any reference I made to LDUP was solely due
to the fact it happens to be the WG considering taking on
LDAP ACM work.  I don't think changing the WG venue matters
much (as the interested parties follow the work).

>  WG with the same members would be able to.

I believe any WG taking on LDAP ACM work will be stalled due
to lack of consensus.  Individuals, not subject to WG
consensus, can produce an LDAP ACM for consideration by the
IETF much faster.

Of course, any LDAP ACM I-D submitted for consideration on
the Standard Track, whether produced by a WG or individuals,
has IETF consensus requirements.

And, in terms of meeting overall desires (powerful, flexible,
extensible, etc.), I think individuals can do better than
a WG in this case.  LDAPext had to remove functionality to
remove contention.  Individuals generally don't have to do
that.

Anybody remember the SGMP/CMOT wars which resulted in SNMP?
Basically I am suggesting a similar approach.  That is, let
each set of individuals develop the very best specification
they can, make "where's the ACM?" buttons ;-) and then
consider how to proceed.

Kurt

---

From: "John Strassner" <[email-masked]>
Date: Fri, 16 Nov 2001 11:34:54 -0700

Kurt,

thanks for the reply. I don't understand why you think it would be more
efficient for a group of authors to individually produce competing drafts
that would then have to go through the same consensus building process
that is inherently present in a working group. In addition, this would
make the logistics for people trying to work on this problem much more
difficult. I also fail to see the analogy with SNMP.

Finally, you seem to be taking the attitude that we should abandon the
current work and start over. I think that this is a mistake. The current
work has represented an increasingly growing consensus through its
development. It represents, imo, a viable starting point, and one that
should not be thrown away just because LDAPext is closing down. Replacing
a good starting point with some indeterminate number of new proposals,
drafted as individual submissions without a working group to help guide
discussions, doesn't seem to be a viable solution at all.

regards,
John

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Kurt D. Zeilenga
Sent: Thursday, November 15, 2001 10:03 PM
To: Chris Apple
Cc: [email-masked]
Subject: Re: Adding to the LDAP ACM to a WG charter

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 16 Nov 2001 12:47:46 -0800

At 10:34 AM 2001-11-16, John Strassner wrote:
>current work and start over.

No, I have suggested that the proponents, as individuals, of the
LDAPext ACM approach develop this into the best damn solution
they can.  And I have suggested those who are proponents of
alternative approaches develop them into the best damn solution
they can.

I am sure the ADs would (or will, LDAPext isn't concluded yet)
give them LDAPext more time if the ADs believed LDAPext could
complete the work in a reasonable amount of time.  But the fact
is that after many long years of trying, LDAPext could not
complete the work.  Not for lack of desire, not for lack of
effort, not for the lack of expertise, and certainly not for
the lack of good work by many good people.  LDAPext could not
complete the work due to a lack of consensus on the overall
approach and on numerous technical details.

The LDUP WG will fair no better than LDAPext would if it is
allowed to continue.  So, if there if the consensus is to
do this work in a WG, I would much rather re-charter LDAPext
(or create a new WG) to do it then to saddle LDUP with yet
another major work item.

Lastly, I note that I concur many of the statements Paul and
Rob regarding this proposed work item, in particular:
  "The problems are factorable, and problems that get factored
  get solved quicker" [Paul in regards to decoupling LDUP work
  from LDAP ACM work].
  <http://www.imc.org/ietf-ldup/mail-archive/msg01232.html>

  Rob's "opinion on the progreess of the acl draft, is that,
  unfortunately, in LDAP life-time terms it is very (if not,
  too) late to successfully progress this to a standard, ...
  the main problem as 'entrenched vendors'" [Rob in
  describing one of the problems the IETF must overcome in
  delivering an LDAP ACM]
  <http://www.imc.org/ietf-ldup/mail-archive/msg01210.html>