Subject: [Geopriv] Common policy identities clarification

From: [email-masked]
Date: Wed, 27 Jul 2005 18:31:41 +0300

Hi,

I've just read the recent mails about common policy identity handling and also the relevant section of the -05 draft, and want to know if I have understood everything correctly.

1. <any-identity> is defined separately from <identity>. Is there a particular reason for doing this in the current way, as opposed to defining <any> as a subelement of <identity>, while keeping <any>'s semantics equal to how <any-identity> is currenctly defined? I think that the "hierarchical" option would be easier to understand.

2. Section 7.1 states that "a rule with no conditions matches any subscription irrelevant whether an authenticated or an unauthenticated was used by the WR to access the resources". I suppose this would be equal to a rule with

<conditions>
  <any-identity/>
</conditions>

Is this correct? (I don't think this is a problem as such, but maybe worth pointing out in the text.)

(In any case I suppose the word identity is missing from the sentence: "...irrelevant whether an authenticated or an unauthenticated IDENTITY was used ...".)

3. I assume that based on the current draft it is possible to define a rule which applies to every identity except [email-masked] by doing this:

<rule id="abc123">
  <conditions>
     <any-identity>
        <except-domain domain="example.com"/>
     </any-identity>
     <identity>
       <domain domain="example.com"/>
         <except entity="joe"/>
     </identity>
  </conditions>
</rule>

This means that you can essentially do the notorious black-lists per identity (remembering that the black-listed identities must not get the permission through some other rule either), only you have to do it in a pretty complicated way... The side effect of this type of condition seems to be that now any unauthenticated id (in addition to joe) from "example.com" would not match the rule either. Right? This is not a major problem, but obviously having exceptions not only for domains but for individual ids would make this easier. Was there some reasoning why domain exceptions are good but id exceptions bad? 

Finally, there is probably a typo in section 7.1 in guideline 3.3. (which deals with <except-domain> under <any-identity>). I believe "MUST" should be replaced with "MUST NOT".

Regards,
	Markus

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv