Subject: [Simple] Comments on xcap-auth-usage-01

From: [email-masked]
Date: Tue, 4 Nov 2003 16:23:51 +0200

- The introduction talks about how the authorisation decision includes decisions on "when" the watcher receives notifications. But nothing in the rest of the text shows how. Is this left over from the last version?

- The <on-list> element says that the statement applies to all users on the specified presence list. What about sub-lists? 
Also, what if a resource in a list points to another list? How does the server learn about the resources in those lists so that it can apply the authorisation permission to them as well?

- The following example is certainly valid:

   <?xml version="1.0" encoding="UTF-8"?>
   <permission-statements>
     <statement id="as8f">
       <applies-to>
         <uri>sip:[email-masked]</uri>
         <except>sip:[email-masked]</except>
       </applies-to>

       <permissions>
        <!-- permissions for joe go here -->
       </permissions>

     </statement>
   </permission-statements>

Joe is included then excepted. Should that be forbidden? or it can be allowed but results in a no-op? The same applies to <domain> and <on-list>

- Why is the id attribute  in <uri> <domain> and <on-list> needed? isn't the values of the elements themselves unique enough?

- Section 4.2.2 second bullet has "(based on the rule permissions)". What are the rule permission?

- show-note element: a tuple can have multiple <note> elements. Which one does the <show-element> select? the first one? all?

- encrypt: This permission does not fit with the rest, and is really not a permission. I can't think at the moment of a place in the xml document where you can place it. As an attribute in the <permissions> element is one idea.

- Section 5 and 5.6 mention compound permissions still.

Regards,
Hisham

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple