Subject: Open Group's Authorization API effort

From: Greg Clark <"greg"@dascom.com>
Date: Wed, 24 Mar 1999 20:26:53 -0800

Following the recent posting from Bob Morgan we understand there are
some questions about the work that is being done at the Open Group with
respect to the standardization of a programmer's interface for
authorization. As most of you are  aware, also within the IETF there are
multiple efforts underway in parallel to understand and standardize
APIs, attribute and credential formats, etc, related to authorization.

The following points hopefully clarify the work at the Open Group and
its relationship to
GAA-API and XGSS:

(1) Open Group Authorization API

An authorization API (AZN-API) is currently under development in an Open
Group effort with an
API submission from a design team based on requirements from a
vendor/user task group.  The initial submission is based on DASCOM
technology.   This submission is going through  peer review in the TOG
process.

As a first visible step in this process, an initial draft of the AZN-API
is expected to be made
available on The Open Group Web site.  This should be well in advance of
the IETF Oslo meeting.
We would welcome comment and feedback on this and subsequent drafts as a
valuable part of the
development of this specification prior to its submission into a formal
process.  A dedicated
mailing list ([email-masked]) has been established to encourage
this wide review and
return of your comments. This is a public list - the only additional
"plus" from membership of
The Open Group is an entitlement to vote during the formal
comment/review process.  Please let
us know if you want to participate in this tgauthz email list to take an
active part in this
process (mail subscribe requests to [email-masked] or
direct to
[email-masked]).

We'll post the CAT list when the API spec is generally available.  This
is planned within 2 weeks.

(2) Relationship to GAA-API

Currently AZN-API is expected to work in the same functional area as
GAA-API (interface to the
Policy Decision Point / Access Control Decision Function) but with a
higher level of
abstraction than the current GAA-API.  We'd see the XGSS services as
complementary to both AZN and GAA.  In the interests of getting maximum
implementation experience it could make some sense for the GAA-API and
AZN-API  efforts to proceed in parallel and get more experience across
multiple independent implementations before deciding whether to proceed
with one or both on the standards track. If there is wider community
interest, we would certainly be pleased to submit the AZN-API spec as an
I-D in the CAT WG. We would also be happy to talk about this work at the
Oslo meeting if this made sense as a part of a CAT agenda slot.

(3) General

If you have any more questions or comments about the AZN-API work,
please use either the CAT WG or the Open Group mailing lists, or contact
the architects below directly.

Thanks,

Greg Clark
CTO DASCOM Inc.
[email-masked]

Frank Siebenlist
Chief Architect
[email-masked]

www.dascom.com
Phone: +1 831/460-3600        Fax: +1 831/460-0255

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]