Subject: VCAR: RIGHTS Value Type : UPN rule part

From: Bernard Desruisseaux <[email-masked]>
Date: Mon, 21 Jan 2002 11:35:55 -0500

The UPN rule part doesn't need the special value
"ANONYMOUS".  The UPN "@" should be used instead.

Regards,
Bernard
-- 
Bernard Desruisseaux                    mailto:[email-masked]
Research & Development                  Tel.  : +1 514 733-8500 x4213
Steltor                                 Fax   : +1 514 733-8878

---

From: Doug Royer <[email-masked]>
Date: Mon, 21 Jan 2002 10:41:20 -0700

> "ANONYMOUS".  The UPN "@" should be used instead.

The problem is what if you want to say I will grant
access to anyone but only in <domain>, use:

	GRANT:...:@domain

or ONLY anonymous within <domain>, use:

	GRANT:...:anonymouns@<domain>

Or anyone anonymous from any domain:

	GRANT:...:anonymous

Just using '@' does not cover all three.
I am open.

---

From: Bernard Desruisseaux <[email-masked]>
Date: Mon, 21 Jan 2002 15:27:01 -0500

> Just using '@' does not cover all three.

I'm missing your point.  You can write:

   GRANT:UPN=@;...

and:

   GRANT:UPN=@example.com;...

The draft doesn't say anything about "anonymous" in UPN.
It simply states that the special UPN "@" is used to
represent anonymous users.

Regards,
Bernard

---

From: Doug Royer <[email-masked]>
Date: Mon, 21 Jan 2002 15:04:03 -0700

> represent anonymous users.

(1) VCAR was added before UPN, so the text in VCAR may need to
    be updated.

(2) SESSION - ID does not specify how to ONLY allow ANONYMOUS@realm.
    Maybe we need to add anonymous to 2.4.4? :

	anonymous@realm

 2.4.4 CAP Session identity

   For anonymous access the identity of the session is "@", a UPN with a
   null Username and null Realm.  A UPN with a null Username, but non-
   null Realm, such as "@foo.com" may be used to mean any identity from
   that Realm, which is useful to grant access rights to all users in a
   given Realm.  A UPN with a non-null Username and null Realm, such as
   "bob@" could be a security risk and MUST NOT be used.

It covered what the above text did not cover:

	How to say ANONYMOUS@<realm-ONLY> (vs. any anonymous?)

        '@' is any anonymous at any realm.

	'@<domain>' is ANY user from that realm.

Looks to me as if we need to update 2.4.4, not remove anonymous
from VCAR. Or perhaps add it to 2.4.4 and update the text in VCAR?