Subject: Re: RFC 2981 (disman event MIB) Implementation Experience

From: Randy Presuhn <[email-masked]>
Date: Thu, 8 Nov 2001 16:20:45 -0800 (PST)

Hi -

> To: [email-masked]
> Subject: event-mib issues/questions:
> From: Wes Hardaker <[email-masked]>
> Date: 29 Jan 2001 17:47:32 -0800
> Message-ID: <[email-masked]>
...
> 0) For mteTriggerTargetTag values of '' (ie, the local agent) is the
>    context name for the request to be the context name as defined
>    later using mteTriggerContextName or the contextName of the
>    incoming request:
>
>      In this case, access to the objects indicated by
>      mteTriggerValueID is under the security credentials of the
>      requester that set mteTriggerEntryStatus to 'active'.  Those
>      credentials are the input parameters for isAccessAllowed from the
>      Architecture for Describing SNMP Management Frameworks.
>
>    I would think it should be the value of mteTriggerContextName that
>    is used, but the isAccessAllowed ASI has the contextName listed as
>    an argument, so the above text would lead me to question if I
>    should be pulling the context name from the packet that set the row
>    active instead?
...

The context name is not part of the credentials (it's used
to identify the information to be accessed, not the pricipal
requesting access), so the TriggerContextName is the one
to use.  Does anything need to be changed to make this 
clearer?

 ------------------------------------------------------
 Randy Presuhn          BMC Software, Inc.  1-3141
 [email-masked]  2141 North First Street
 Tel: +1 408 546-1006   San José, California 95131  USA
 ------------------------------------------------------
 My opinions and BMC's are independent variables.
 ------------------------------------------------------

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 20 Nov 2001 15:52:20 -0800

>>>>> On Thu, 8 Nov 2001 16:20:45 -0800 (PST), Randy Presuhn <[email-masked]> said:

Randy> Hi -

(Sorry for the delay.)

>> should be pulling the context name from the packet that set the row

Randy> ...

Randy> The context name is not part of the credentials (it's used to
Randy> identify the information to be accessed, not the pricipal
Randy> requesting access), so the TriggerContextName is the one to
Randy> use.  Does anything need to be changed to make this clearer?

No, re-reading it I'm less confused (but then again it was accompanied
with your explanation).

The proper thing to do, I think, would be to write a new section that
explicitly lists the fields from the various SNMP message types to
date that would be used as credentials.  I realize the text is written
in a supposedly independent manner, but it does make it a bit more
vague because of this.  A section that discussed "Security Credentials
contained in SNMP versions to date" would probably be helpful.

-- 
"Ninjas aren't dangerous.  They're more afraid of you than you are of them."