Subject: DN types and IP addresses in draft-ietf-ldapext-acl-model-04.txt

From: "David Ward" <[email-masked]>
Date: Thu, 14 Oct 1999 09:48:58 -0600

Section 6.2.2 defines the DN types access-id, group, and role.  It states, "an acess-id is a non-collection (non-group and non-role objects) DN that can be authenticated."  If I am understanding this correctly, this means the <subjectDN> must be a DN if the <dnType> is access-id.  

However, in section 8, the subjectDN parameter for the controls & extensions is opened up to include "a DN or another string such as IPAddress".  How is the subjectDN parameter different than the subjectDN in the ACI attribute?  The controls & extensions calculate effective rights for a subject.  What would it mean to calculate the effective rights of an IP address?  

According to the definition in 6.2.2, you can not use an IPAddress as the subject in the ACI attribute.  If someone wants to support IP addresses as the subject in an ACI, section 6.2.2 indicates this can be done by defining an additional DN type.

David

---

From: Ellen Stokes <[email-masked]>
Date: Tue, 19 Oct 1999 05:14:45 -0500

Thanks for pointing out theconflicting statements.  I'll fix.
The intent here is to support more than just DN in the subject DN, such as
ipaddress.  You'll notice that we've defined subjectDN to be a LDAPstring
instead of a LDAPDN to allow those alternative non-DN subjects.  But if you're
using a real DN, then it is assumed that the format you'll using in subjectDN
is LDAPDN (which is really a subset of LDAPstring).
Ellen

At 09:48 AM 10/14/1999 -0600, David Ward wrote:
>Section 6.2.2 defines the DN types access-id, group, and role.  It states,
"an acess-id is a non-collection (non-group and non-role objects) DN that
can be authenticated."  If I am understanding this correctly, this means
the <subjectDN> must be a DN if the <dnType> is access-id.  
>
>However, in section 8, the subjectDN parameter for the controls &
extensions is opened up to include "a DN or another string such as
IPAddress".  How is the subjectDN parameter different than the subjectDN in
the ACI attribute?  The controls & extensions calculate effective rights
for a subject.  What would it mean to calculate the effective rights of an
IP address?  
>
>According to the definition in 6.2.2, you can not use an IPAddress as the
subject in the ACI attribute.  If someone wants to support IP addresses as
the subject in an ACI, section 6.2.2 indicates this can be done by defining
an additional DN type.