Subject: Re: grant / deny precedence indraft-ietf-ldapext-acl-model-04.txt

From: "David Ward" <[email-masked]>
Date: Fri, 15 Oct 1999 09:26:45 -0600

I agree there are two items and I agree with the proposed defaults. 

>>> Mark Smith <[email-masked]> 10/15/99 8:48:48 AM >>>
> "Miklos, Sue A." wrote:
> 
> I agree that the model should have a consistent default condition.  I
> also prefer that the default be "deny" and that only after all rights
> necessary have been validated, should a "grant" condition occur.

To clarify, I think there are two different items for discussion:

a) Default access: in the absence of any access control rules, what
access is granted?  I think the answer should be "none" since this is
the safest default.

b) Precedence of grant and deny: when a "grant" and a "deny" clause both
apply, is access granted or denied?  I think access should be denied,
which is to say that "denies" win out over "grants."

-- 
Mark Smith
iPlanet Directory Architect / Sun-Netscape Alliance
My words are my own, not my employer's.   Got LDAP?

---

From: "Daniel A. Oliver" <[email-masked]>
Date: Fri, 15 Oct 1999 08:56:10 -0700

> access is granted?  I think the answer should be "none" since this is

Agreed.

Looking at this from the customer's perspective (customers such as legal,
educational, and/or government organizations), defaulting access to "none"
is a critical requirement.

In the event that a new server is being installed into a production
environment containing controlled data, defaulting to a
'front-page-of-the-New-York-Times' security level represents a tremendous
risk.

- just my $0.02

> which is to say that "denies" win out over "grants."

ditto