Subject: RE: LDAPv3 Replication Access Control Design Team Report

From: "Timothy Hahn" <[email-masked]>
Date: Tue, 10 Sep 2002 08:19:24 -0400

Hi all,

Since "silence" seems not to be an option in this case, I'll log my opinion
here as siding IN FAVOR of the proposed work program.

My reasoning here is that I feel that
a) something needs to be done with respect to maintaining the security
around information access, even when that information is subject to being
replicated across a heterogeneous set of servers
b) mandating any one particular access control model implementation is (as
has been noted) a "rat hole" that is too deep and slimy to be productive
c) a mechanism for identifying an access control model + agreement that,
within an area of replication, a single access control model is applied is
a good way to "isolate" this problem from the main LDUP tasks of defining a
replication model (wire flows, data formats, administrative actions).

By isolating the problem, we can "agree to disagree" (as a collective
group) and still make progress on a replication protocol.  The approach
will also allow for those that CAN come to some agreement on an access
control model to be able to employ LDUP mechanisms.

I think that inserting this "level of indirection" with respect to access
control model frees up the LDUP WG to concentrate on replication flows
instead of being "stuck" as it has been for quite some time.

Regards,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Durham/IBM@IBMUS
phone: 919.224.1565     tie-line: 8/687.1565
fax: 919.224.2540

---

From: "Liben, Michael (GTS)" <[email-masked]>
Date: Tue, 10 Sep 2002 09:27:47 -0400

I believe the security issues to be a business/technical problem that falls outside of the replication protocol. There are other mechanisms required to ensure that a server is trusted. The replicator
always has the option of not replicating with an untrusted partner.

Mike 

-----Original Message-----
From: Timothy Hahn [mailto:[email-masked]] 
Sent: Tuesday, September 10, 2002 8:19 AM
To: [email-masked]
Subject: RE: LDAPv3 Replication Access Control Design Team Report

Hi all,

Regards,
Tim Hahn

---

From: John McMeeking <[email-masked]>
Date: Tue, 10 Sep 2002 09:05:54 -0500

I agree with Tim.

I see this as similar to how X.501 separates the general security model
from a specific access control model.  The X.501 security model defines a
mechanism for identifying the access control schema and its scope of
control, while its Basic Access Control defines one (of possibly many)
access control schemes.

I think we need the security model portion.  At a minimum it provides a
basis for determining whether all the servers support a given access
control scheme.  Beyond that, if a server supported multiple access control
schemes, it provides a framework for specifying which access control scheme
is used for some area of the DIT, or how servers should behave in the
presence of differing or identical acces control schemes.

We do not need to specify a specific access control scheme.  We need to
ensure that LDUP makes consistent access control across servers possible,
possibly specifying that ACI is replicated (if the specific scheme
represents ACI as operational attributes and/or LDAP objects).  I'm sure
some folks would love it if they could manage access control across a
hetergenous directory network, but that is a much tougher nut to crack --
both from the perspective of agreeing on such a beast, and then getting
vendors to implement it.

Given the security model pieces, we can then define how LDUP should handle
ACI information.  For example:
- If the same access control scheme is used on two servers that replicate
to one another, the attributes and / or LDAP objects that define ACI are
replicated.
- If different access control schemes are used -- writeable server(s) use
same model to control updates, read only servers might allow anonymous
searches to all data -- LDUP could use this knowledge to not replicate the
same attributes and / or objects.

The above does not require that we define a specific scheme, only that we
have a means to identify -- possibly select -- the access control model
used by various servers for a given area of the DIT, and that a server that
implements an access control model know how to behave with respect to
replication of access control information.

John  McMeeking
[email-masked]

                      Timothy                                                                                                          
                      Hahn/Durham/IBM@I        To:       [email-masked]                                                             
                      BMUS                     cc:                                                                                     
                      Sent by: owner-          Subject:  RE: LDAPv3 Replication Access Control Design Team Report                      
                      ietf-ldup@mail.                                                                                                  
                      imc.org                                                                                                          

                      09/10/2002 08:04                                                                                                 
                      AM                                                                                                               

Kurt,

My opinions below.

Regards,
Tim Hahn

                      "Kurt D.

                      Zeilenga"                To:       <capple@dsi-
consulting.net>
                      <[email-masked]        cc:       <ietf-ldup@imc.
org>
                      g>                       Subject:  RE: LDAPv3
Replication Access Control Design Team Report
                      Sent by:

                      owner-ietf-ldup@m

                      ail.imc.org

                      09/10/2002 08:42

                      AM

Let's cut to the key question:

  Does LDAP replication REQUIRE a standard LDAP ACM?

(REQUIRE here in the RFC 2119 sense).
TJH> I believe that LDAP replication MUST ensure that the security
TJH> (i.e. authorization to access - add/modify/search/delete)
TJH> is NOT compromised by the LDAP replication mechanism defined.
TJH>
TJH> Thus, I believe that LDAP replication REQUIRES that access
TJH> control issues be "attended to" (in the RFC 2119 sense).
TJH>
TJH> But I DO NOT feel that LDAP replication needs define a specific
TJH> Access Control Model (ACM).  LDAP replication need only ensure
TJH> that SOME ACM can be applied across the servers involved in the
TJH> data replicated amongst them and that LDAP replication doesn't
TJH> "mess that up".

If the consensus is yes, then we should determine how this
requirement is going to be fulfilled.  (I note that the
proposed plan doesn't produce a standard LDAP ACM.)

If the consensus is no, then we need not determine how an
LDAP ACM will or will not be produced.  It simply can remain
out of scope.

TJH> Unfortunately, I don't believe the answer is as "binary"
TJH> as this.  LDAP replication REQUIRES that things be done
TJH> "securely" but it does NOT REQUIRE a specific ACM.

I see little point is discussing the details of the plan
until we've actually agreed upon requirements...

Kurt

---

From: John McMeeking <[email-masked]>
Date: Tue, 10 Sep 2002 09:10:59 -0500

Mike,

I believe your reply addresses authentication of servers to each other in
replication.  I think that is a separate issue from LDUP requirements or
behavior with respect to ensuring (or enabling) clients have the same
authroity to access data on each of multiple replicas.  The latter issue is
what this report addresses.

John  McMeeking

                      "Liben, Michael                                                                                                  
                      (GTS)"                   To:       Timothy Hahn/Durham/IBM@IBMUS, [email-masked]                              
                      <mliben@exchange.        cc:                                                                                     
                      ml.com>                  Subject:  RE: LDAPv3 Replication Access Control Design Team Report                      
                      Sent by: owner-                                                                                                  
                      ietf-ldup@mail.                                                                                                  
                      imc.org                                                                                                          

                      09/10/2002 08:27                                                                                                 
                      AM                                                                                                               

I believe the security issues to be a business/technical problem that falls
outside of the replication protocol. There are other mechanisms required to
ensure that a server is trusted. The replicator
always has the option of not replicating with an untrusted partner.

Mike

-----Original Message-----
From: Timothy Hahn [mailto:[email-masked]]
Sent: Tuesday, September 10, 2002 8:19 AM
To: [email-masked]
Subject: RE: LDAPv3 Replication Access Control Design Team Report

Hi all,

Regards,
Tim Hahn

---

From: "Liben, Michael (GTS)" <[email-masked]>
Date: Tue, 10 Sep 2002 10:58:42 -0400

No, that's exactly what I had in mind. Preserving security context across servers for access control is well beyond the scope of the protocol.

Mike

---

From: "Paul Leach" <[email-masked]>
Date: Tue, 10 Sep 2002 17:23:44 -0700

> From: Richard Huber [mailto:[email-masked]] 
> Sent: Tuesday, September 10, 2002 4:35
> To: [email-masked]
> Subject: Re: LDAPv3 Replication Access Control Design Team Report
> 
> 
> 
> I agree with Tim.
> 
> If access controls are being used in a directory, the 
> directory administrator has decided that it is important to 
> control access to all or part of the data in the tree.  So if 
> replication is used in a directory that has access controls, 
> there needs to be a way to make sure that those access 
> controls are not lost because of replication.
> 
> A standard access control mechanism for all LDAP directories 
> is one way to do this.  But it can also be done by making 
> sure that the ACM in effect for any given part of the DIT is 
> well defined, and that the definition can be carried as part 
> of the data being replicated.

Or it can be carried out of band.

> 
> So as Kurt noted, the design team did not propose a plan to 
> design the one true access control mechanism.  But we do need 
> a replicatable way to express what ACM is in effect at any 
> point in the DIT.  Otherwise, administrators will have to 
> choose between reliability (multiple copies via replication) 
> and data security (access controls).

No -- they can independently configure it at each replica. Often not
very convenient, but it does show that it is possible to divorce ACM
from replication. As long as the authorization policy and the shape of
the DIT don't change very often, then it may not be all that big a
problem.

For example -- if I just replicate all my users' email SMIME
certificates to another directory, then saying that they are world
readable at the server level may be all the access control I need.

> 
> If, as discussed by John McMeeking and Kurt, this leads to a 
> general framework for replicating policy information, so much 
> the better.  This makes it possible to replicate policy 
> information if the situation so demands.

Policy information that is stored as directory objects with no special
semantics will get replicated just like any other object. That holds for
authorization policy too. Heterogenous directories that agree on the
schema for said objects will replicate their policy transparently. Ones
that don't, won't, and their administrators will have to arrange that
the correct policy gets configured in some other way at all replicas.
The replication protocol need say nothing more than that. 

Paul

---

From: "Liben, Michael (GTS)" <[email-masked]>
Date: Thu, 12 Sep 2002 08:53:49 -0400

Once the directory data is replicated to another administrative authority, that authority owns access control, including its definition. If both replicas are governed by a common authority, then the
ACM data can travel as an attribute of the object.

-----Original Message-----
From: Richard Huber [mailto:[email-masked]] 
Sent: Tuesday, September 10, 2002 7:35 PM
To: [email-masked]
Subject: Re: LDAPv3 Replication Access Control Design Team Report

I agree with Tim.

If access controls are being used in a directory, the directory administrator has decided that it is important to
control access to all or part of the data in the tree.  So if replication is used in a directory that has access
controls, there needs to be a way to make sure that those access controls are not lost because of replication.

A standard access control mechanism for all LDAP directories is one way to do this.  But it can also be done by
making sure that the ACM in effect for any given part of the DIT is well defined, and that the definition can be
carried as part of the data being replicated.

So as Kurt noted, the design team did not propose a plan to design the one true access control mechanism.  But we do
need a replicatable way to express what ACM is in effect at any point in the DIT.  Otherwise, administrators will
have to choose between reliability (multiple copies via replication) and data security (access controls).

If, as discussed by John McMeeking and Kurt, this leads to a general framework for replicating policy information, so
much the better.  This makes it possible to replicate policy information if the situation so demands.

Requiring that LDUP make this possible is not the same as requiring that LDUP make this happen automatically.  I
agree with Kurt that LDUP should not automatically negotiate what policy data to transfer.  But LDUP should make it
possible to transfer policy data where needed, and we need the administrative structure to make this doable.

I believe that is where the design team proposal is heading.

Rick Huber

Timothy Hahn wrote:

>                       Zeilenga"                To:       <[email-masked]>
>                       <[email-masked]        cc:       <[email-masked]>
>                       g>                       Subject:  RE: LDAPv3 Replication Access Control Design Team Report
>                       Sent by:
>                       owner-ietf-ldup@m
>                       ail.imc.org
>
>
>                       09/10/2002 08:42
>                       AM
>
>
>

---

From: John McMeeking <[email-masked]>
Date: Fri, 13 Sep 2002 08:23:27 -0500

Kurt,

It's been a while since I've dabbled in "necessary and sufficient" ;-)

I'll grant that replication of access control attributes (or other policy
information) is not "sufficient" to ensure equivalent enforcement of that
policy on different servers, though in some cases (perhaps quite common),
it will be sufficient.  You earlier referenced a note that explained that
quite well.

Replication of access control information (where the specific scheme has
any attributes to replicate) is, however, "necessary."  And a few of us
think that a standard framework for access control would go a long way
towards enabling LDUP to satisfy the necessary conditions that are within
the realm of LDUP.  We can use that framework to specify which operational
attributes should or should not be replicated under given agreements.

John  McMeeking

                      "Kurt D.                                                                                               
                      Zeilenga"                To:       Timothy Hahn/Durham/IBM@IBMUS                                       
                      <[email-masked]        cc:       [email-masked]                                                   
                      g>                       Subject:  Re: LDAPv3 Replication Access Control Design Team Report            
                      Sent by:                                                                                               
                      owner-ietf-ldup@m                                                                                      
                      ail.imc.org                                                                                            

                      09/12/2002 05:14                                                                                       
                      PM                                                                                                     

At 12:32 PM 2002-09-12, Timothy Hahn wrote:
>With respect to your comment:
>
>"Likewise, a standard framework for non-standard ACMs, by itself, is not
>sufficient."
>
>I have to ask:  Why not?

Because, like a standard ACM, any common non-standard ACM would
also depend on identity management and other security services.

>But it seems to me that for "replication", we're clearly talking about
LDAP
>"server"s communicating with one another, with the intent that if a
>"client" lands on any one of those "replicating" servers, that the results
>of their query will be the SAME (modulo the "eventual convergence" issues
>of course).

That's one of may uses.  Another use is replicating information
between enterprises under some agreement .  This agreement can
allow each enterprise to define its own access control policy
(for access to the replicated information in that enterprise).
Other is where one uses two LCUP to replicating information
between an internal-use-only server and a publicly-accessible
server.

For security reasons, it may be inappropriate to replicate
access control information between servers!

>How can such a thing be provided unless the same access
>control semantics are applied (with respect to the information
replicated)?

By divorcing itself from those semantics!

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 13 Sep 2002 07:08:07 -0700

At 06:23 AM 2002-09-13, John McMeeking wrote:
>any attributes to replicate) is, however, "necessary."

But is necessary for LDUP to have any understanding that the
attributes to replicate hold access control information?  Is
in not sufficient to provide a means to transfer operational
information where the administrator, as stated in the replication
agreement, that this information should be transferred?

Is not it necessary, for security and other reasons, to not only
allow the administrator to control which user application attributes
are transferred, but to control which operational attributes
are transferred?

Why wouldn't these controls be insufficient for controlling
the transfer of access control information?

Kurt