Subject: Updated Proposed update to Netconf Charter

From: "Sharon Chisholm" <[email-masked]>
Date: Mon, 11 Jul 2005 08:28:13 -0400

hi

Here is the updated proposed charter extension for phase 2. I have split
access control out from the data model framework and have added a couple
items that people have mentioned. Obviously some of this will need to
get deferred to phase 3, in the absence of infinite resources.

"Additional phase 2 work including:

- Requirements and Guidelines for defining Netconf data models to enable
interoperable, netconf implementations. Requirements will be defined
around specification language,  compliance, backwards compatibility,
depicting relationships, event specification, and application error
message specification.

- Framework for netconf access control. This access control mechanism
should consider integration with existing deployed solutions. It should
define a common authentication scheme.

- An initial set of application-level re-usable data types such as IP
Addresses, MAC addresses, etc. This definition would be compliant to the
above defined requirements and guidelines for Netconf content.

- A concrete data model (XML Schema) for reporting information about the
Netconf system. This definition would be compliant to the above defined
requirements and guidelines for Netconf content.

- A netconf protocol specification for asynchronous messaging to enable
the sending of event messages. This must preserve the netconf layers."

- A method of delivering software loads over netconf.

- A method of supporting multi-channels.

Sharon Chisholm
Nortel 
Ottawa, Ontario
Canada

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 11 Jul 2005 15:08:22 +0200

> define a common authentication scheme.

I don't know what the second sentence buys us - considering the integration
with existing deployed solutions probably applies to almost all WGs in
the IETF. On the other hand, having this sentence in the charter may
lead to nasty discussions down the road if people start to force NETCONF
access control to be compatible with VACM. I also fail to understand why
you mix authentication in here. We already have netconf transports with 
different authentication schemes - do you want to open that can of worms?

I suggest to only keep the first sentence and to remove the other two
sentences or to clarify them.

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: "Randy Presuhn" <[email-masked]>
Date: Mon, 11 Jul 2005 14:10:54 -0700

Hi -

> From: "Sharon Chisholm" <[email-masked]>
> To: "netconf" <[email-masked]>
> Sent: Monday, July 11, 2005 5:28 AM
> Subject: Updated Proposed update to Netconf Charter
...
> define a common authentication scheme.
...

Access control mechanisms are about a lot more than just authentication.
They involve the identification of the information to which access should
be controlled, the identification of the possible operations, the
identification of the roles/principals requesting access, and more.  When
you write "integration with existing deployed solutions", are you considering
just the authentication aspect, or are you considering some mechanism
for the distribution / maintenance of access control policies?

Randy