Subject: CAP: UPN (User Principal Name)

From: Bernard Desruisseaux <[email-masked]>
Date: Thu, 31 Jan 2002 11:02:01 -0500

I would like to propose the following syntax and semantic
for UPN values that can be specified in the GRANT and DENY
properties in VCAR components for the purpose of authorization.

   OWNER       The owner of the VAGENDA in which the
               encapsulating VCAR is stored

   NONOWNER    All users except the owner of the VAGENDA
               in which the encapsulating VCAR is stored

   *           All users (including anonymous)

   @           All anonymous users from unnamed realms

   @*          All anonymous users from all named realms

   @realm      All anonymous users from specified realm

   *@*         All named users from all named realms

   *@realm     All named users from specified realm

   user@realm  Specified user from specified realm

   user@*      Specified user from all named realms

Examples,

   GRANT:[email-masked]   # Grant user identified as
                               # "[email-masked]"

   DENY:NOWOWNER               # Deny non owner of the VAGENDA

   GRANT:[email-masked]         # Grant all named users from realm
                               # "steltor.com"

   GRANT:@steltor.com          # Grant anonymous users from the
                               # realm "steltor.com"

Regards,
Bernard
-- 
Bernard Desruisseaux                    mailto:[email-masked]
Research & Development                  Tel.  : +1 514 733-8500 x4213
Steltor                                 Fax   : +1 514 733-8878

---

From: [email-masked] (Steve Mansour)
Date: Thu, 31 Jan 2002 09:04:47 -0800

>    @           All anonymous users from unnamed realms

could you explain the difference between * and @  ??   Examples?

-Steve

---

From: Bernard Desruisseaux <[email-masked]>
Date: Thu, 31 Jan 2002 12:21:42 -0500

> could you explain the difference between * and @  ??   Examples?

"GRANT:*" will grant all users, that is, anonymous and
non-anonymous (e.g, "@", "@toto.com", "[email-masked]",
and "sman@").

"GRANT:@" will only grant anonymous from unnamed realms, that
is, "@" will be granted, but NOT "@toto.com", "[email-masked]"
and "sman@".

Regards,
Bernard

---

From: Doug Royer <[email-masked]>
Date: Thu, 31 Jan 2002 16:17:17 -0700

> properties in VCAR components for the purpose of authorization.

You have confused the REALM part of the UPN and called
it 'from' realm below. They are not the same.

If I authenticate as [email-masked]' by connecting to 
'calendar.steltor.com' it says NOTHING about where I connected
FROM. It just says that my UPN is [email-masked]' I may
have connected from 'i-hacked-you.com'.

>                encapsulating VCAR is stored

It means you name is in the OWNER property of the VAGENDA - correct?

>                in which the encapsulating VCAR is stored

It means your name is NOT in the OWNER property of the VAGANDA -
correct?

>    *           All users (including anonymous)

Okay.

>    @           All anonymous users from unnamed realms

Okay.

>    @*          All anonymous users from all named realms

What would and un-named realm be?

>    @realm      All anonymous users from specified realm

Are you saying that the CS MUST do a reverse lookup and
determine that they are in fact connecting 'from' realm?

OR are you saying that they supplied anonymous@realm
as their UPN during authentication?

>    *@*         All named users from all named realms

How is that different than '*' ?

>    *@realm     All named users from specified realm

All named users that have a UPN with @realm at the end?

Or all valid UPNs that connect and the reverse lookup
says they are in fact connecting from the 'from' realm?

>    user@realm  Specified user from specified realm

OR specifies that 'user@realm' was entered for the authentication?
and they can in fact connect from any realm?

>    user@*      Specified user from all named realms

Connecting from any realm, or supplying any realm?

>    GRANT:[email-masked]         # Grant all named users from realm

So, can I connect from royer.com but supply a UPN
of [email-masked]' ?

Or are you saying that 'bernard' is only valid when connecting
from realm 'steltor.com' ?
 
>    GRANT:@steltor.com          # Grant anonymous users from the

But only connecting from steltor.com , or connecting from any?

---

From: Bernard Desruisseaux <[email-masked]>
Date: Thu, 31 Jan 2002 20:00:59 -0500

> it 'from' realm below. They are not the same.

It was not my intent.  You might want to help me with my
English though!  Are users "in a realm", "part of a realm",
"of a realm"?

> It means you name is in the OWNER property of the VAGENDA - correct?

Correct.

> It means your name is NOT in the OWNER property of the VAGANDA -

Correct.

> What would and un-named realm be?

user
user@

Though I'm not user this form is useful.  What do you think?
Can you suggest a description if you want to keep it?

> determine that they are in fact connecting 'from' realm?

NO!

> as their UPN during authentication?

What users will supply will depend on the authentication
mechanism used.  I'm simply proposing that anonymous
"of a" (?) given realm be identified as "@realm".

> How is that different than '*' ?

"@", "doug@" and "@example.com" won't match.

> All named users that have a UPN with @realm at the end?

YES!

> says they are in fact connecting from the 'from' realm?

NO!

> and they can in fact connect from any realm?

Again, users won't necessarily provide their UPN for
the authentication.  So "user@realm" only means that
the currently authenticated user is IDENTIFIED with
a specified "user" and a specified "realm".

> Connecting from any realm, or supplying any realm?

Neither.  IDENTIFIED "in a" (?) specified realm.

> of [email-masked]' ?

Yes.

> from realm 'steltor.com' ?

No.

> But only connecting from steltor.com , or connecting from any?

Connecting from anywhere.  But there might be a site policy
that would enforce, as part of an authentication mechanism,
that only users connecting FROM the "Internet domain" steltor.com
can be IDENTIFIED as "@steltor.com".

Could we talk of "Internet domains" or "domains" when refering to
connections (e.g., users connecting from the domain steltor.com)
and talk of realm only for user identify (e.g., user identified
"in the" (correct me here) realm steltor.com)?

Regards,
Bernard