Subject: partial lock access rights

From: Andy Bierman <[email-masked]>
Date: Thu, 13 Dec 2007 06:19:57 -0800

Hi,

I do not not understand why the session requesting a partial lock
must have "at least read access" to the data indicated by the request.
Since locks in NETCONF have no affect whatsoever on reading data,
I do not see the purpose of this requirement.

I could see the increased security achieved by requiring write access
to all the data that a partial-lock covers, but I don't see the point
of checking read access, in order to grant a partial lock.

Andy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>

---

From: Balazs Lengyel <[email-masked]>
Date: Thu, 13 Dec 2007 15:46:31 +0100

Hello,
The draft is careful and only says: for example read rights. What it really says is: you must 
have some rights.
As you have pointed out, we do not know what the access control model is, but we can assume 
that there is some kind of access model in place.
Balazs

-- 
Balazs Lengyel                       Ericsson Hungary Ltd.
TSP System Manager
ECN: 831 7320                        Fax: +36 1 4377792
Tel: +36-1-437-7320     email: [email-masked]

---

From: Andy Bierman <[email-masked]>
Date: Thu, 13 Dec 2007 07:10:02 -0800

Balazs Lengyel wrote:
> Hello,
> The draft is careful and only says: for example read rights. What it 
> really says is: you must have some rights.
> As you have pointed out, we do not know what the access control model 
> is, but we can assume that there is some kind of access model in place.

I think the requirement should be removed because this
document is supposed to be a standard.  I don't see
how "assume some rights in some sort of access control model"
is supposed to be inter-operable.

Andy