Subject: [netconf] Secdir last call review of draft-ietf-netconf-restconf-notif-13

From: Aanchal Malhotra via Datatracker <[email-masked]>
Date: Thu, 11 Apr 2019 14:54:10 -0700

Reviewer: Aanchal Malhotra
Review result: Ready

The document is very clear and concise.  I just have one minor clarification question.
Section 3.4 Page 9 that says the following:
"In addition to any required ........SHOULD only be allowed......".  

Is there a reason for using SHOULD instead of MUST?

---

From: "Reshad Rahman (rrahman)" <[email-masked]>
Date: Fri, 12 Apr 2019 21:29:35 +0000

Hi Aanchal,

Thanks for the review. Please see inline.

On 2019-04-11, 5:54 PM, "netconf on behalf of Aanchal Malhotra via Datatracker" <[email-masked] on behalf of [email-masked]> wrote:

    

There may be reasons why an implementation decides not to enforce this restriction. Going by RFC2119 definitions, this is why we chose SHOULD instead of MUST.
3. SHOULD   This word, or the adjective "RECOMMENDED", mean that there
   may exist valid reasons in particular circumstances to ignore a
   particular item, but the full implications must be understood and
   carefully weighed before choosing a different course.

Regards,
Reshad.    
    _______________________________________________
    netconf mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/netconf

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 19 Apr 2019 22:56:13 -0500

> There may be reasons why an implementation decides not to enforce this restriction. Going by RFC2119 definitions, this is why we chose SHOULD instead of MUST.

If you have some reasons in mind, it is often helpful to list them as
examples of when the recommended behavior would not be followed.

Thank you Aanchal for the review!

-Ben

---

From: "Reshad Rahman (rrahman)" <[email-masked]>
Date: Wed, 24 Apr 2019 17:53:02 +0000

On 2019-04-19, 11:56 PM, "Benjamin Kaduk" <[email-masked]> wrote:

What we had in mind is a "super-user" who could be given access to subscriptions of other users. Is this obvious or should I can add text to that effect at the end the bullet below? Something along the lines of "For example, a RESTCONF username with the required administrative permissions could be allowed to invoke RPCs modify-subscription, resync-subscription and delete-subscription on a subscription which was created by another username.".

   o  In addition to any required access permissions (e.g., NACM), RPCs
      modify-subscription, resync-subscription and delete-subscription
      SHOULD only be allowed by the same RESTCONF username [RFC8040]
      which invoked establish-subscription.

Regards,
Reshad.

    -Ben

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 28 Apr 2019 22:00:03 -0500

>       which invoked establish-subscription.

I think it might help to have such text, though I would suggest a slightly
pithier "Such a restriction generally serves to preserve users' privacy, but
exceptions might be made for administrators that may need to modify or
delete other users' subscriptions."

Thanks,

Ben

---

From: "Reshad Rahman (rrahman)" <[email-masked]>
Date: Mon, 29 Apr 2019 20:03:55 +0000

On 2019-04-28, 11:00 PM, "Benjamin Kaduk" <[email-masked]> wrote:

Good with me, thanks. I'll make this addition in the next rev.

Regards,
Reshad.

    Thanks,
    
    Ben