Subject: [weirds] Security Requirements: Authorization

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 8 Oct 2012 12:57:23 +0000

>From "Inventory of WHOIS Service Requirements Final Report":

Implement an authorization framework that is capable of providing granular (per registration data object) permissions (access controls).

>From RFC 3707:

The protocol MUST NOT prohibit an operator from granularly assigning multiple types of access to data according to the policies of the operator.

The protocol MUST provide an authentication mechanism and MUST NOT prohibit an operator from granting types of access based on authentication.

The protocol MUST provide an anonymous access mechanism that may be turned on or off based on the policy of an operator.

Thoughts on these requirements?  3707 doesn't say much about authorization. It describes the requirements listed above in the context of access control.

Scott

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Sat, 20 Oct 2012 21:35:41 -0700

> Thoughts on these requirements?  3707 doesn't say much about authorization. It describes the requirements listed above in the context of access control.

It seems to me that an RDAP server that includes non-mandatory HTTP
authentication support solves all of these.  If the client doesn't
authenticate, it's anonymous, and the server can decide what (if
anything) to return and what per-IP-address rate limit might be
appropriate to enforce.  If it does, then again the server can make
specific decisions about what fields (if any) to return, and rate
limiting can be done if needed regardless of the client's IP address;
such privileged access is also easy to revoke down to the anonymous
level if abused.

-MSK

---

From: "John Levine" <[email-masked]>
Date: 21 Oct 2012 15:29:20 -0000

>authentication support solves all of these.

It does, but keep in mind the point about federated authentication
among groups of servers.  OAuth solves a real problem, although I am
not sure at this point whether it solves a WEIRDS problem.

R's,
John

---

From: Peter Koch <[email-masked]>
Date: Mon, 22 Oct 2012 15:33:22 +0200

> Thoughts on these requirements?  3707 doesn't say much about authorization. It describes the requirements listed above in the context of access control.

the "MUST NOT prohibit an operator" clauses in the first two might benefit
from a more positive wording, although I tend to understand that "MUST NOT
prohibit" and "MUST allow" are different things.  It's hard to see where a
protocol could really prohibit the operator applying some access controls,
except in an - unfortunately not too unliklely - case where the protocol
spec gets (mis-)used as a service description.

-Peter