Subject: Re: CAP: VCAR - limiting READ

From: Bernard Desruisseaux <[email-masked]>
Date: Thu, 20 Dec 2001 16:00:19 -0500

Doug Royer wrote:
> 
> For security reasons, a site may wish a CUA to only see GRANT and DENY
> values for which it has access. So I propose an additional paragraph
> to section "2.4.4 Access Rights - Summary":
> 
> A CS may limit the results sent to a CUA in reply to a METHOD READ
> on a VCAR to a set that applies to the current session identity.
> That is if user 'Joe' is the current session identity, then when
> 'Joe' asks to see the VCARs, the CS might only return a VCAR that effects
> 'Joe'. In this way 'Joe' can not see who does have other access.

Good idea, but I could simply setup my VCAR to deny you
the right to read all my VCARs altogether.

In any case, I think we should add your idea as a MAY in
the specification.

Regards,
Bernard
-- 
Bernard Desruisseaux                    mailto:[email-masked]
Recherche et développement              Tél.  : +1 514 733-8500 x4213
Steltor                                 Fax   : +1 514 733-8878

---

From: "John Stracke" <[email-masked]>
Date: Thu, 20 Dec 2001 16:45:56 -0500

> 'Joe'. In this way 'Joe' can not see who does have other access.

Nit: that should be "affects".  To effect Joe would be to cause him to 
exist.  That's his parents' job.  :-)

/==============================================================\
|John Stracke                   |Principal Engineer            |
[email-masked]  |Incentive Systems, Inc.       |
|http://www.incentivesystems.com|My opinions are my own.       |
|==============================================================|
|No matter how subtle the wizard, a knife in the shoulderblades|
|will cramp his style.                                         |
\==============================================================/