Subject: bearer certificates and VCARs and draft 6, oh my

From: [email-masked] (tipjar LLC)
Date: Tue, 11 Dec 2001 16:12:45 -0700 (MST)

The feature I've been scouring all drafts for, which is the
ability to designate a role without specifying who you are 
designating, is again missing.  The section on the VCAR in draft
six even places the association of the VCAR to the CU (rather than
the session) in the MUST category:

   VCARs MUST be specifically granted to an authenticated CU.

If the protocol is to support rights given to a session based on
presentation within the session of some kind of certificate which
would cause the session to gain that right, we might need to
add "or session" to 2.4.2 summary.  

It also appears in 2.4.4 that the identify command remains, contrary
to rumour of its demise (yes, I am looking at draft 6).  I think
that a suggested syntax involving the identify command would be
a good choice for the question of how one would present a bearer
authorization certificate to have additional VCARs added to the
current session, should the committee approve of the concept.

--
Tipjar Administrator and general stone in your shoe,
David Nicol

---

From: "Paul B. Hill" <[email-masked]>
Date: Tue, 11 Dec 2001 19:40:28 -0500

I disagree. First, certificates have nothing to do with the issue.
Certificates are simply one mechanism of providing an authentication.

Suppose a VCAR says something like,
"GRANT:UPN=[email-masked];ACTION=*;OBJECT=*;VALUE=*;"

Now you might authenticate using BEEP TLS profile, using an X.509
certificate that doesn't contain your username but instead asserts that you
are "[email-masked]". But soley relying on certificates to do
something like this is pretty limiting.

Suppose that instead you authenticate using the SASL profile and you are
able to authenticate as David Nicol, but use a SASL authorization ID of
[email-masked]. That will also work.

I feel that the methods described in CAP are much more flexible than your
suggestion and we are enabling the underlying requirements that you are
looking for.

Paul

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of tipjar LLC
Sent: Tuesday, December 11, 2001 6:13 PM
To: [email-masked]
Subject: bearer certificates and VCARs and draft 6, oh my

---

From: Doug Royer <[email-masked]>
Date: Tue, 11 Dec 2001 23:12:04 -0700

> add "or session" to 2.4.2 summary.

The 'certificate' has some name, hostname, or some unique (to CAP) ID
associated with it. A CU does not have to be a person. A CU is
*anything*
that uses CAP.

> current session, should the committee approve of the concept.

I don't recall certificate's being discussed in the requirements doc.
And 'identify' is for changing ID, not adding (2.4.4).