Subject: Re: GAA and XGSS

From: Denis Pinkas <[email-masked]>
Date: Mon, 09 Nov 1998 16:37:41 -0800

Simon,

Thanks for your interrest about XGSS. I have been away for my office for about 10
days, hence the reason for not answering earlier.

I have just re-posted today to the IETF web manager a version of the previous
draft so that every one interrested may pick it up again. Only the dates and my
E-mail address have been changed. A few updates would be needed to reflect the
learning from the implementation, but this is minor changes.

I have expressed my interrest to the authors of the GAA draft and I am in contact
with them.

> > The xgss draft has not been actively discussed within the CAT-WG for some
> > time (the last meeting reference I can locate, e.g., was at the December
> > 1997 meeting) and is not currently pending IESG consideration for
> > advancement to RFC status. In order to request its progression on behalf of
> > a WG, IETF procedure requires apparent constituency and consensus on a
> > document.  Are other WG members also committed to this specification, and/or
> > awaiting its progression?
> >
> > --jl
> >
>
> We are not committed to the XGSSAPI at this stage but will incorporating
> access control to a project later on. Obviously we will wish to use common
> standard interfaces. From my understanding I guess the XGSSAPI and the GAA-API
> are competing drafts.

XGSS and GAA follow different approaches. XGSS allows to extract the privileges
from the credentials while GAA considers the credentials as an opaque structure
and compares them with autorization data attached with the object. When the
operation to be performed on the object is presented, then a yes/no answer is
returned. When no operation to be performed on the object is presented, then all
the operations allowed on that object are returned. With XGGS the authorization
data is left undefined while with GAA it has to be structured. One current
limitation of GAA is that it restricts the authorization data to ACLs structures
making the scheme ACL dependent. Allowing at least capabilities would be nice, but
in any case the autorization data will not be as flexible as this is the case for
XGSS. So there may be room for both approaches.

In addition XGSS provides means for a target acting as an initiator (in a
delegation role) to examine where it can forward the credentials. GAA does not
presently support this kind of functionality.

Does this help ?

Denis

> Simon
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-==-=-=-=-=-=-=-=
> Simon Gibson,                                      Telephone: +61 7 3864 5120
> Research Scientist, Security Unit,                 Facsimile: +61 7 3864 1282
> CRC for Distributed Systems Technology,
> Queensland University of Technology,           email:<[email-masked]>
> Brisbane Qld 4001, Australia.                          http://www.dstc.edu.au
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]