Subject: RE: [Simple] Who can modify an XCAP usage XML document

From: [email-masked]
Date: Fri, 3 Oct 2003 13:06:10 +0300

> -----Original Message-----
> From: ext Jonathan Rosenberg [mailto:[email-masked]]
> Sent: Friday, October 03, 2003 6:39 AM
> To: Khartabil Hisham (NMP-MSW/Helsinki)
> Cc: [email-masked]
> Subject: Re: [Simple] Who can modify an XCAP usage XML document
> 
> 
> 
> 
> [email-masked] wrote:
> 
> > Hi,
> > 
> > In the current XCAP proposal (and I assume in the revised version
> > to be available soon), it is assumed that the creator of an XML
> > usage document is the sole member of a virtual access list. I.e. It
> > is only the creator who can modify the XML document.
> 
> Right. The idea was that this was the default policy. If you 
> wanted to 
> have a different policy, you could define an xcap usage that, itself, 
> specified what those policies are. The server would then need to 
> understand that application usage.

Yes, this is something we talked about in the interim meeting. The issue there was how to link the 2 application usages?

> 
> 
> > 
> > I believe this is a limitation and some changes need to be made to
> > such a problem. 2 solutions are possible
> > 
> > 1. Require that each XCAP usage document define an ACL type of
> > list. One way of mandating this is by requiring XML documents in an
> > XCAP usage to have an element that carries URIs of resources that
> > have read/write access of a document.
> 
> Careful - if you include the acl in the document then anyone who can 
> write the document can also change the acl. The essence of what I am 
> saying above is that you have the acl as a separate document, and the 
> default policy for THAT document is that only the domain 
> administrator 
> and the user can change it.

I agree this is a bad idea.

> 
> 
> > The syntax of that element
> > can be left up to the usage document. For example, a usage document
> > can define something like:
> > 
> > <ACL privilege="read-write">sip:[email-masked]</ACL>
> > 
> > 2. Somehow generalise this in the base XCAP document using a HTTP
> > header or something in an multipart body.
> 
> I'm not sure I follow what this means.

I mean that the ACL can be carried in an HTTP header. But don't worry, I think its another bad idea. What you describe above, IMO, in the right solution.

> 
> It was my intention to try to address this, using the mechanism I 
> mention above, in a subsequent document, which could (I think) be 
> defined later. Can you give the specific usage you had in 
> mind? Do you 
> think it can't wait to be defined at a later time?

It can certainly wait. The specific usage we had in mind is the CPCP usage. Currently the privileges are carried in the XML document itself. We recently concluded (you made the same conclusion) that its a bad idea, so we ripped it out of the I-D ( -01 to be published soon).

We also concluded that this type of thing can be done with a separate usage document that can be specified at a later date.

Thanks,
Hisham

> 
> Thanks,
> Jonathan R.
> 
> 
> -- 
> Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
> Chief Technology Officer                    Parsippany, NJ 07054-2711
> dynamicsoft
> [email-masked]                     FAX:   (973) 952-5050
> http://www.jdrosen.net                      PHONE: (973) 952-5000
> http://www.dynamicsoft.com
> 
> 
> 

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: [email-masked]
Date: Fri, 3 Oct 2003 13:06:10 +0300

Thanks,
Hisham