Subject: Re: Basic Access Control for LDAP

From: "Ed Reed" <[email-masked]>
Date: Wed, 27 Feb 2002 11:52:50 -0700

One question from reading the drafts (for now) -

What constitutes a "user" for the purpose of ACI UserClasses value allUsers?

Ed

=================
Ed Reed
Reed-Matthews, Inc.
+1 585 624 2402
http://www.Reed-Matthews.COM
Note:  Area code is 585

>>> "Steven Legg" <[email-masked]> 02/25/02 10:02PM >>>

Folks,

I've submitted two I-Ds that together describe a profile of the X.500
Basic Access Control and Simplified Access Control schemes for use in LDAP.
Both drafts are now available from the on-line Internet-Drafts directories.

	Title		: Access Control Administration in LDAP
	Author(s)	: S. Legg
	Filename	: draft-legg-ldap-acm-admin-00.txt
	Pages		: 11
	Date		: 22-Feb-02
	
This document adapts the X.500 directory administrative model for use
by the Lightweight Directory Access Protocol.  The administrative
model partitions the Directory Information Tree for various aspects
of directory data administration, e.g. subschema, access control and
collective attributes.  The generic framework that applies to every
aspect of administration is described, along with the particular
definitions that support Access Control administration.  This
document does not define a particular access control scheme.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-legg-ldap-acm-admin-00.txt 

	Title		: Basic and Simplified Access Control in LDAP
	Author(s)	: S. Legg
	Filename	: draft-legg-ldap-acm-bac-00.txt
	Pages		: 41
	Date		: 22-Feb-02
	
An access control scheme describes the means by which access to
directory information and potentially to access rights themselves may
be controlled.  This document adapts the X.500 directory Basic Access
Control and Simplied Access Control schemes for use by the
Lightweight Directory Access Protocol.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-legg-ldap-acm-bac-00.txt 

Cheers,
Steven

---

From: "Steven Legg" <[email-masked]>
Date: Thu, 28 Feb 2002 17:16:38 +1100

Ed,

> What constitutes a "user" for the purpose of ACI UserClasses 

In the first instance it is anyone/anything who manages to bind in,
regardless of their authorization identity, but it is qualified by
the AuthenticationLevel and whether a permission is being granted
or denied.

For a permission being granted:

1) If the AuthenticationLevel is "none" then allUsers includes everyone,
regardless of authorization identity, anonymous included.

2) If the AuthenticationLevel is "simple" then allUsers includes all
users who have authenticated with at least a user name and password.
Anonymous users and users who have not been authenticated are excluded.

3) If the AuthenticationLevel is "strong" then allUsers includes all
users who have authenticated with strong credentials, e.g digital
signatures. Anonymous users, unauthenticated users and password
authenticated users are excluded.

For a permission being denied, allUsers includes everyone,
regardless of authorization identity and authentication level.

Regards,
Steven