Subject: [Simple] Authorization Rules for groups

From: "Noga Tor" <[email-masked]>
Date: Tue, 22 Aug 2006 15:37:57 +0300

Hi

I was wondering if there is any way to define an authorization rule that
will apply to (RLS) contact list groups?

For example:
Presentity Alice (sip:[email-masked]) has defined an RLS contact list
called Alice-friends (sip:[email-masked]).
Is it possible for Alice to define a policy sinlge rule that will apply to
all members of group "Alice-friends"?

I have looked at the draft document detailing the presence policy rules (
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-common-policy-11.txt
).
I have found no evidence that such an action is possible. the rule allows
only the "one" or "many" options. Neither of these options, (to my
understanding) can be applied to such an RLS group and the only option is to
define each and every presentity in its own "one" tag.

I would appreciate your prompt respnose.

Thanks a lot
Noga
_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Tue, 22 Aug 2006 16:55:01 +0200

Hi Noga, 
 
we discussed the aspect of groups some time back. 
 
I recall that the conclusion was the following: 
(without searching through my mails)
 
If you have a list of friends in your group then you would replace every
entity in the group with the specific instance of the group. 
 
Here is an example: You have a group sip:[email-masked] that
contains 
sip:[email-masked], sip:[email-masked] and sip:[email-masked]

The rule set would contain these three identities rather than some
identity for the entire group. 
 
You might argue about the performance improvement if you could just
convey a single rule instead of multiple onces. Given that you might not
update your rules every few seconds and that you might not have too many
groups with the same authorization right it might not be so dramatic at
the end.

Do you see a problem with this approach? 

Ciao
Hannes
 ________________________________

	Von: Noga Tor [mailto:[email-masked]] 
	Gesendet: Dienstag, 22. August 2006 14:38
	An: [email-masked]
	Betreff: [Simple] Authorization Rules for groups

	Hi 
	 
	I was wondering if there is any way to define an authorization
rule that will apply to (RLS) contact list groups?
	 
	For example:
	Presentity Alice (sip:[email-masked]) has defined an RLS
contact list called Alice-friends (sip:[email-masked] ). 
	Is it possible for Alice to define a policy sinlge rule that
will apply to all members of group "Alice-friends"? 
	 
	I have looked at the draft document detailing the presence
policy rules
(http://www.ietf.org/internet-drafts/draft-ietf-geopriv-common-policy-11
.txt
<http://www.ietf.org/internet-drafts/draft-ietf-geopriv-common-policy-11
.txt> ).
	I have found no evidence that such an action is possible. the
rule allows only the "one" or "many" options. Neither of these options,
(to my understanding) can be applied to such an RLS group and the only
option is to define each and every presentity in its own "one" tag. 

	Thanks a lot
	Noga

---

From: "Noga Tor" <[email-masked]>
Date: Mon, 28 Aug 2006 16:03:27 +0300

I have no problem with this approach. It seems very logical to me the
Presence XDMS will not have any knowledge of groups (RLS XDMS).

However, I have bumped into an OMA test fest use case, which implies that
such a connection should exist. I will append the text of the use case and
let me know what u think...

Presence-1.0-int-0123 Authorization management for groups

Test Case Id

Presence-1.0-int-0123

Test Object

UEs with Presence Source, Presence Watcher and XDMC functionality, Presence
Server, and Shared XDMS.

Test Case Description

Verify that a Presence Server can handle the Presence Rules document for
groups of watchers stored in the Shared XDMS.

*TEST CASE GOAL: *Verify that a UE, acting as a XDMC, can modify his
permissions for groups of watcher stored in the Shared XDMS, and the PS
handles these permissions properly.

Specification Reference

Refer to Appendix A

SCR Reference

Refer to Appendix A

Tool

N/A

Test Code

N/A

Preconditions

·         Equipment:

o        2 UEs (with User1, User2 credentials)

o        Presence Server

o        Presence XDMS

o        Shared XDMS

·         Prerequisite for this test:

o        In the Presence XDMS, the Presence Authorization Rules document
contains information that Group A is authorized to see any of the presence
information belonging to User1.

o        User2 is a member of Group A as defined by User1

o        UE2 capable of displaying presence information.

o        User1 and User2 will have a set of commonly supported Presence
elements.

o        User1 has no active publications.

o        User1 has the ability of changing the content of its Presence
Authorization Rules Document.

o        User2 has no active subscriptions.

Test Procedure

1.        User1 publishes presence information for all commonly supported
mandatory Presence elements.

2.        User2 subscribe to presence information from User1.

3.        User1 updates the Authorization Rules Document in PS XDMS to block
Group A to see his presence.

4.        User1 modifies the active presence information that has been
published.

Pass-Criteria

2.        UE2 display the presence information from User1.

4.        UE2 does not display any presence information from User1.

Thanks
Noga

---

From: <[email-masked]>
Date: Mon, 28 Aug 2006 18:06:01 +0300

Hi,
 
I can see some little misunderstanding here. The presence rules document
does not refer to any RLS service here. The situation tested by this
test case is that user Dave has some resource-lists document in Shared
XDMS 
 
<resource-lists>
  <list name="friends">
    <entry>Alice</entry>
    <entry>Bob</entry>
    <entry>Charles</entry>
  </list>
</resource-lists>
 
And the same user Dave has presence-rules document in Presence XDMS
 
<ruleset>
  <conditions>
    <external
anchor=http://SharedXdms/resource-lists/users/sip:[email-masked]/index/
~~/resource-lists/list%5b@name=%22friends%22%5d
<BLOCKED::http://SharedXdms/resource-lists/users/sip:[email-masked]/ind
ex/~~/resource-lists/list[@name="friends"]> />
  </conditions>
  <actions>
    <sub-handling>allow</sub-handling>
  </actions>
  <transformations></transformations>
</ruleset>
 
Using reference to some list defined in Shared XDMS the user can use
something like "controlling access to presence information" for some
group of users. Note that neither RLS service is referenced nor list in
rls-services document.
 
br, Martin

	From: Noga Tor [mailto:[email-masked]] 
	Sent: 28. srpna 2006 15:03
	To: [email-masked]; Tschofenig, Hannes
	Subject: Re: [Simple] Authorization Rules for groups

	I have no problem with this approach. It seems very logical to
me the Presence XDMS will not have any knowledge of groups (RLS XDMS). 
	 
	However, I have bumped into an OMA test fest use case, which
implies that such a connection should exist. I will append the text of
the use case and let me know what u think...

	-- cut --