Subject: [Simple] xcap/geopriv alignment, issue 1: conditions

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 24 Nov 2003 00:56:05 -0500

Folks,

This is one of a few mails I will send out regarding differences in 
the models and operations between the geopriv policy mechanism (which 
you can find at 
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-policy-00.txt ) 
and xcap-auth.

In the current xcap-auth spec, the only place where a policy is 
conditionally applied is with the accept-if statement. It allows you 
to say, for example, that the subscription should be accepted if the 
watcher was anonymous:

<applies-to>
   <domain>example.com</domain>
</applies-to>

<accept-if>
   <anonymous/>
</accept-if>

In xcap-auth, conditional checks are used within the applies-to tag, 
so that an entire policy statement can be conditional, rather than 
just a piece of it. The benefit of this approach is that, once a 
condition (such as "if anonymous") is defined, you can make all kinds 
of policy choices based on it, besides accept/reject. FOr example, I 
can decide to give out only certain information to anonymous watchers.

Moving the condition tag into applies-to would look like this:

<applies-to>
   <domain>example.com</domain>
   <anonymous/>
</applies-to>

<accept/>

Note that a statement is used if all of the conditions listed match. 
That is, its an AND operation, not OR.

So, the question is, do we follow the geopriv model here, and make 
conditions part of the applies-to tag only? I believe we should, as it 
gives us more functionality at no cost, independent of any desire for 
alignment.

Comments?

Thanks,
Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Ben Campbell <[email-masked]>
Date: Mon, 24 Nov 2003 15:04:08 -0600

Jonathan Rosenberg wrote:

> Folks,
> 
> This is one of a few mails I will send out regarding differences in the 
> models and operations between the geopriv policy mechanism (which you 
> can find at 
> conditionally applied is with the accept-if statement. It allows you to 
> say, for example, that the subscription should be accepted if the 
> watcher was anonymous:
> 
> <applies-to>
> In xcap-auth, conditional checks are used within the applies-to tag, so 
> that an entire policy statement can be conditional, rather than just a 
> piece of it. The benefit of this approach is that, once a condition 
> (such as "if anonymous") is defined, you can make all kinds of policy 
> choices based on it, besides accept/reject. FOr example, I can decide to 
> give out only certain information to anonymous watchers.
> 

Agreed.

---

From: Ben Campbell <[email-masked]>
Date: Mon, 24 Nov 2003 15:04:08 -0600

Agreed.

---

From: Robert Sparks <[email-masked]>
Date: Tue, 25 Nov 2003 14:05:16 -0600

I agree that moving the conditional from an accept-if into
the applies-to tag is the right thing to do.

There is at least one ramification that needs to be carefully documented
if we do this.

There needs to be a way to say things like "I'll accept (whatever)
if it is authenticated using either Digest or an S/MIME signature."

In xcap-auth-01, I think this was acheivable with multiple accept-if's
inside a permission (but am not sure where I got this idea - accept-if
is missing from the schema).

With this proposed change, we will have to either have to 
have multiple permissions (one that accepts if digest and another
that accepts if s/mime) or add an OR function to the list of things 
in applies-to.

I can accept having to state this using multiple permissions.

RjS

---

From: Robert Sparks <[email-masked]>
Date: Tue, 25 Nov 2003 14:05:16 -0600

RjS