Subject: Re: [Simple] Who can modify an XCAP usage XML document

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 02 Oct 2003 23:38:43 -0400

[email-masked] wrote:

> Hi,
> 
> In the current XCAP proposal (and I assume in the revised version
> to be available soon), it is assumed that the creator of an XML
> usage document is the sole member of a virtual access list. I.e. It
> is only the creator who can modify the XML document.

Right. The idea was that this was the default policy. If you wanted to 
have a different policy, you could define an xcap usage that, itself, 
specified what those policies are. The server would then need to 
understand that application usage.

> 
> I believe this is a limitation and some changes need to be made to
> such a problem. 2 solutions are possible
> 
> 1. Require that each XCAP usage document define an ACL type of
> list. One way of mandating this is by requiring XML documents in an
> XCAP usage to have an element that carries URIs of resources that
> have read/write access of a document.

Careful - if you include the acl in the document then anyone who can 
write the document can also change the acl. The essence of what I am 
saying above is that you have the acl as a separate document, and the 
default policy for THAT document is that only the domain administrator 
and the user can change it.

> The syntax of that element
> can be left up to the usage document. For example, a usage document
> can define something like:
> 
> <ACL privilege="read-write">sip:[email-masked]</ACL>
> 
> 2. Somehow generalise this in the base XCAP document using a HTTP
> header or something in an multipart body.

I'm not sure I follow what this means.

It was my intention to try to address this, using the mechanism I 
mention above, in a subsequent document, which could (I think) be 
defined later. Can you give the specific usage you had in mind? Do you 
think it can't wait to be defined at a later time?

Thanks,
Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 02 Oct 2003 23:38:43 -0400

Thanks,
Jonathan R.