Subject: Should ACI be part of CAP1 to the expense of delays ?

From: Andre Courtemanche <[email-masked]>
Date: Tue, 8 Dec 1998 13:15:35 -0500

Bob,

I share the position on the ACIs and wished we covered
the ACI's in CAP1, understanding that it will delay
the draft. This is not share by the other editors of
the requirement. 

Lets see what the opinion is on the list about this:

Should Access control information be defined in CAP1
to the expense of a later draft ?

Please voice it on the list.

-----Original Message-----
From: Bob Mahoney [mailto:[email-masked]]
Sent: Tuesday, December 08, 1998 12:17 PM
To: [email-masked]
Subject: Access Control deferred?

Yesterday during the meeting I asked about the conflict between the
deferred items in section 4.9 and the apparent inclusion of security
measures in the slides shown.  Can one of the document authors clarify
this?

I am concerned that we are designing an access protocol without access
control.  That would be unacceptable.  Clients need to provide a
mechanism
for users to allow or disallow access to their personal calendars, and
relying on an administrator to take this action clearly does not scale.
(We consider our organization's calendar users to number ~16,000)

The slides seemed to conflict with the draft.  If I'm merely confused,
can
someone clarify?

>4.9     Access Control (deferred)
>
>The ability to get and set access control data on calendars and
>calendar components is useful, but beyond the scope of the initial
>CAP specification. A CS may apply access control entries to calendars
>and components, but CAP need not specify how these are to be set and
>retrieved. Access control entries could be set and retrieved by
>administrators on the CS through another protocol. Additionally, a CS
>can enforce the class of each component, by restricting access to
>"confidential" and "private" components, without any design in CAP to

-Bob
>allow this.

---

From: Bob Mahoney <[email-masked]>
Date: Tue, 08 Dec 1998 14:37:55 -0500

>Please voice it on the list.

I think it's essential that it is included.  At least rudimentary access
control must be available to calendar users directly (as opposed to calling
their administrators on the phone). 

I realize we wasted a good deal of time in the earlier work we've done, I
think we've all learned a lot, and I expect the coming work to be more
efficient.  (optimism rears it's ugly head)

I am more interested in a correct solution than one that meets an arbitrary
deadline.  Yes, delay is bad, and we've all waited a long time.  But we
have to solve the problem.  Allowing anyone to access user calendars is not
solving the problem.  Neither is requiring administrator intervention for
every user's ever access control change.

If we have to defer something, I vote that we do a follow-up "CAP-lite"
subset for PDAs.  PDA users already accept the limitations of their
devices, and may well be quite willing to accept lessened functionality
(even security functionality), to have particular apps on their pocket devices.

-Bob

---

From: Mark Schiller <[email-masked]>
Date: Tue, 08 Dec 1998 18:20:06 -0800

remove