Subject: Re: [Simple] xcap/geopriv alignment issue 5: permission data types

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 02 Dec 2003 15:03:24 -0500

inline.

Ben Campbell wrote:

> Jonathan Rosenberg wrote:
> 
>> Folks,
>>
>> In the current xcap-auth spec, there is a big assumption that each 
>> permission (show-element, show-namespace, accept, accept-if, etc.) is 
>> basically a token datatype. If multiple statements apply, the overall 
>> permissions are the union across these tokens.
>>
>> However, in the geopriv spec, they define some additional data types. 
>> Namely, they define boolean and integer. Combining operations are then 
>> also defined for these types (logical OR for booleans, MAX operator 
>> for integers).
>>
>> As an example, lets say you have a permission called "accuracy":
>>
>> <applies-to>
>>   <uri>sip:[email-masked]</uri>
>> </applies-to>
>>
>> <accuracy>10</accuracy>
>>
>>
>>
>> <applies-to>
>>   <domain>cisco.com</domain>
>> </applies-to>
>>
>> <accuracy>5</accuracy>
>>
>>
>> This would have the effect of granting an accuracy of 5 to everyone in 
>> Cisco, excepting fluffy who would get 10.
>>
>> The question, then, is whether or not to define/allow these data types 
>> and also define their combining rules. NOTE WELL - you would need to 
>> properly define your permissions such that, for an integer, a larger 
>> value is always more permissive. For booleans, TRUE would need to 
>> always be more permissive.
> 
> 
> I am having trouble understanding how this is any different than 
> previously proposed, at least in the case of your example. Previously, 
> this simply meant 2 rules matched fluffy--so if 10 is more permissive 
> than 5, he effectively has 10.

Well, previously, the spec didnt say anything about how to combine 
integers.

> Would this proposal allow a combination 
> rule that would give fluffy 15?

No. It would say that, for types that are integers, the combining 
operation is MAX().

> 
> 
>>
>> A related issue is whether or not to convert some of our current 
>> permissions from tokens to booleans. In particular, the accept, 
>> all-content and show-note permissions would become booleans. The 
>> benefit of that is that you can explicitly say no by setting a value 
>> to false:
>>
>> <applies-to>
>>   <uri>sip:[email-masked]</uri>
>> </applies-to>
>>
>> <accept>false</accept>
>>
>>
>> would explicitly reject any subscriptions from Henning.
> 
> 
> Hmm. I assume that if another matching rule sayd <accept>true</accept> 
> then true would win, right? Otherwise, we no longer have additive 
> permissions.

Yes. The combining operator is OR().

Hannes writes:
> You raised an interesting issue addressing rule permission combining. You
> might want to take a look at our geopriv authz draft.  
> 
> The draft describes how permissions are combined for some cases. However, as
> noted in the geopriv wg meeting there are still some technical issues to
> achieve the expected behavior. We pointed to a subset of issues (i.e.,
> default behavior) in our presentation at
> http://www.tschofenig.com/geopriv/IETF58/Geopriv_policies_ietf58.ppt (slide
> 22/23). 
> 
> In a more sophisticated example you might even have to define a lattice. You
> can find an example in Section 7.4 of our draft. 
> 
> My conclusion is that we have to look carefully at examples to verify the
> result. In Jonathan's example below you need to make sure that you carefully
> define what 'true' and 'false' means. The same is true for values like
> accuracy. 

I'm confused about what the problem is. Once you define the data types 
and then define a combining operator, you just need to be careful 
about how you use them. As long as, for any integer type, a larger 
value is more permissive than a smaller one, you should be OK.

In the case of the "provide civil location" transformation, it seems 
to me that this is basically an integer, whose values are mapped to a 
pnemonic that describes the level. So:

#define NULL 0
#define COUNTRY 1
#define REGION 2
#define CITY 3
#define BUILDING 4
#define FULL 5

thus, if one statement grants you country, and another grants you 
building, you get building (MAX(1,4) = 4).

Am I missing something?

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 02 Dec 2003 15:03:24 -0500

inline.

#define NULL 0
#define COUNTRY 1
#define REGION 2
#define CITY 3
#define BUILDING 4
#define FULL 5

Am I missing something?

-Jonathan R.