Subject: [Simple] Questions on XCAP Usage for Authorization

From: "Naoko ITO" <[email-masked]>
Date: Fri, 3 Oct 2003 22:30:17 +0900

Hello,

I have some questions on XCAP Usage for Authorization.

The draft says,
   The overall authorization for a watcher is represented by the union
   of the permissions granted to that watcher.
 and
   In that case, the union of the permissions across those statements
   is applied to the subscription.

Am I correctly understanding that the overall authorization is
determined by simply putting together every permission related to a
specific watcher?

Then, some questions occur to me.

- Is there any way to reject a watcher who is given permissions by
  other statements?
  ex) Give a permission to any user whose domain is "example.com" but
      Joe.
- Is there a way to have a default policy which can be overridden by
  other statements? It seems possible to reject, or not to give a
  permission to all the watchers by default and add permisions to
  specific users only. But it does not seem possible to accept every
  user by default unless listed on a black list.
- How to solve the conflicts between two or more permissions related to
  one watcher?

I understand this is still under discussion, as it says,

      OPEN ISSUE: Another model is that you take permissions for the
      most specific match. I think union makes more sense in the model
      where the entries in the statement are permissions.

but it'd be greatful if I can be provided any idea on this.

Thank you in advance.

Best Regards,
-----
Naoko Ito / NEC

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple