Subject: Comments on aci-model-04

From: "David Chadwick" <[email-masked]>
Date: Sun, 17 Oct 1999 23:43:34 +0100

***************************************************

David Chadwick
IS Institute, University of Salford, Salford M5 4WT
Tel +44 161 295 5351  Fax +44 161 745 8169
Mobile +44 790 167 0359
Email [email-masked]
Home Page  http://www.salford.ac.uk/its024/chadwick.htm
Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string MLJ9-DU5T-HV8J

***************************************************

Comments on acl-model-4
1) There is ambiguity over whether aCIMechanism is single valued or multi-valued. 
The text says "the value (an OID)" whereas the definition says "list of access 
control mechanism (sic)". If it is single valued then the definition should include 
SINGLE-VALUE
2) Like Jim, I am also confused over the precise definitions of role and group. If 
group refers to a group of names, which I suspect it does, please state this clearly. 
It seems to me in 6.4.1. that the two examples with group have different 
semantics, one refers to a group of names and the other to a subtree. It is not good 
in my opinion to attach two different semantics to one DN type. If role refers to a 
non-leaf object (container or subtree) then can you please rename it so that it is 
clearer. If it does not, then I think that this type (subtree) is missing from dnType 
and should be added.
3) I think you need to add Delete rights to attributes (6.2.1.1). This will be needed for 
the Modify operation (i.e. you have to have permission to both add and delete 
attribute values).
4) You gave an example of a printer as a pointed to object, but said that Use was not 
applicable to it. I should have thought that it was applicable, and that Use could 
mean that the subject was allowed to send a document to the printer.
5) Midway down p15, you said:
.is the equivalent of

              aci: 1.2.3.4#subtree#grant;r,w;[all];
                    r,attribute1#group#cn=Dept XYZ
This should be 
             aci: 1.2.3.4#subtree#grant;r,w;[all];$grant;
                    r,attribute1#group#cn=Dept XYZ

6) Immediately below this, with the example for an empty permission, could you 
also add a note to say that "Alternatively this could be achieved by having a 
permission of deny;r,s;attribute1" so that usage of deny is also shown.
7) In 7.2, there is a possible security weakness, by implying that an access denied 
exception report is returned. The attacker then knows that the information exists. 
By contrast, X.500 can reply "information not present", so that an attacker cannot 
differentiate between information that is not present and information that is 
present but that he does not have access to.
8) Section 8 and 9. When asking for effective rights, do you think that there is value 
in allowing an administrator to set the subjectDN to "all", meaning return the 
rights for everyone who has access to this object. This would necessitate definition 
of a third well known value.
9) A major omission from the document is that nowhere could I find the mapping 
from required rights to LDAP operations. This should be included for each LDAP 
operation (even if in some cases it is simply that one right is needed for a 
particular operation e.g. delete an entry). The complex one is obviously the search 
operation. I suggest you need read rights for every attribute returned and search 
rights for every attribute in the filter.
10) A possible missing right is readDN for an entry. This cannot be fully covered by 
read attribute rights, as the latter will only give rights to the RDN, not the DN.
11) Section 9.1.2. There is no sense in setting the criticality on the response. This text 
should be removed. Ditto 9.2.2

---

From: Ellen Stokes <[email-masked]>
Date: Tue, 19 Oct 1999 04:59:15 -0500

David,

>control mechanism (sic)". If it is single valued then the definition
should include 

The attribute is multi-valued.  I'll change the textual definition to make
OID plural.

>group refers to a group of names, which I suspect it does, please state
this clearly.

In implementation, group and role tend to both be implemented as a group of
names.
However, a group is just a collection of names where the group name can be
used to shorthand access to some object or attribute.  Role is similar, the
difference
being that role also has a set of implied permissions/actions associated
with that role.
(It's a security thing...)

>the Modify operation (i.e. you have to have permission to both add and
delete 

I think you're right - and we're investigating...

>mean that the subject was allowed to send a document to the printer.

I'll add this as the Use example.

>                    r,attribute1#group#cn=Dept XYZ
Yes, I'll make the correction.

>present but that he does not have access to.

Agreed, will fix.

>of a third well known value.

I agree, we do need notation to specify 'all'.  Given that subjectDN is a
LDAPstring,
I can add a sentence that says that '*' in this parameter means all as you
described.

>should be removed. Ditto 9.2.2

Yes, I'll remove.

Ellen

---

From: "David Chadwick" <[email-masked]>
Date: Tue, 19 Oct 1999 14:25:38 +0100

> 
> In implementation, group and role tend to both be implemented as a group
> of names. However, a group is just a collection of names where the group
> name can be used to shorthand access to some object or attribute.

Ellen,

This is the bit I am objecting to, i.e. the attaching of two different 
semantics to group - one where the name of the group is a 
shorthand for the group e.g. o=ibm,c=us, - the other where the 
name of the group points to a group of names object where the 
enclosed names bear no relationship to the name of the group 
e.g.cn=ldapext, dc=netscape, dc=com.

I therefore am proposing that you have two separate values for 
dntype, to reflect the differences. Lets call them subtree and group.

David

David Chadwick

---

From: Ellen Stokes <[email-masked]>
Date: Tue, 19 Oct 1999 23:49:36 -0500

David,
I think perhaps I didn't write myresponse clearly.  There is only
one type of group and it contains a group of names, e.g. groupOfNames object.
It is the name of the group that is typically placed on an access control
list (implementation) to state the access for the names (DNs) contained
in that group.
Ellen

---

From: "David Chadwick" <[email-masked]>
Date: Thu, 21 Oct 1999 23:17:32 +0100

Date forwarded: 	Tue, 19 Oct 1999 21:50:50 -0700 (PDT)
Date sent:      	Tue, 19 Oct 1999 23:49:36 -0500
To:             	[email-masked]
From:           	Ellen Stokes <[email-masked]>
Subject:        	Re: Comments on aci-model-04
Copies to:      	[email-masked]
Forwarded by:   	[email-masked]

> one type of group and it contains a group of names, e.g. groupOfNames
> object. It is the name of the group that is typically placed on an access
> control list (implementation) to state the access for the names (DNs)
> contained in that group. Ellen

Then I would ask that subtree be added please

David

David Chadwick