Subject: [Atoca] What information is used for authorization?

From: Hannes Tschofenig <[email-masked]>
Date: Sat, 15 Jan 2011 21:31:16 +0200

Hi all, 

it was Igor again who raised a question regarding authorization at the IETF#79 ATOCA meeting. He was wondering whether we would only consider the identity of the originator for authorization or some other information as well.
 
Are we considering trait-based authorization, see http://www.rfc-editor.org/rfc/rfc4484.txt,  to be utilized in this context? 

So, what model do we envision? 
What other information is useful in the context of an authorization decision? 

Ciao
Hannes

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 16 Jan 2011 17:20:07 +0200

Hi Art, 

I think it would be useful to have an example here. 

For example, it would be important to know to whom the individual (in our terminology the Author of the Alert message) would authenticate himself to.

Also, it might be useful to know what a gateway, relay or even a Receiver (not to talk about a Recipient) would do with this information. 

Then, with 'credentialling agency' you mean the entity that issued the credentials to the individual (the Author). For example, in a public key based system we are talking about the certificate authority here. Right?

Ciao
Hannes

On Jan 15, 2011, at 11:51 PM, Art Botterell wrote:

> I'd suggest requiring credible identification of the individual and of the credentialling agency.  (Not every gateway will necessarily honor credentials from every issuer.)   Different gateways could then apply different policies based on those and on message contents, including potentially special CAP parameters or other fields as desired locally.
> 
> Thanks!
> 
> - Art
> 
> On Jan 15, 2011, at 11:31 AM, Hannes Tschofenig <[email-masked]> wrote:
> 
>> Hi all, 
>> 
>> _______________________________________________
>> earlywarning mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/earlywarning

---

From: Art Botterell <[email-masked]>
Date: Sat, 15 Jan 2011 13:51:21 -0800

Thanks!

- Art

---

From: "Richard L. Barnes" <[email-masked]>
Date: Mon, 17 Jan 2011 09:59:35 -0500

At a high level, the question of what *information* is used for authorization is not one for this group to consider.  That's a policy question, not an engineering question.  Our focus should be specifying *containers* for such information; at most, we specify what *can* be used for authorization, not what *will* be.

At a technological level, I would suggest that we take this in steps.  

Identity-based access control is clearly low-hanging fruit: There are long-standing mechanisms in several protocols (HTTP, SIP, XMPP, etc.) for authenticating users either with shared secrets or with PKIX certificates.  

PKIX-based authentication in particular can also support some forms of attribute-based authorization, e.g., based on CA identity, CP OID, or extensions like the Clearance attribute [1].  This approach has the benefit that several organizations already have the necessary authentication/authorization infrastructure -- there's not necessarily a need for any new credentials or processes.

Once we have something basic in place based on these technologies, then we can certainly look at ways of adding additional attributes, say using SAML or attribute certificates.

--Richard

[1] <http://tools.ietf.org/html/rfc5913>