Subject: draft-ietf-ldapext-acl-model-06.txt - please publish

From: Ellen Stokes <[email-masked]>
Date: Fri, 14 Jul 2000 11:08:40 -0500

I-D editor,

Please publish this draft as an update to draft-ietf-ldapext-acl 
model-05.txt.
This is a document of the ldapext working group.

Thanks.

LDAPEXTers,

This draft has been reworked based on the access control model meetings
held in Adelaide and subsequent telephone conferences and email from
participants in those meetings.

We used the principles of simplicity and usability to guide us as well
as X.500 where applicable.  There are items in X.500 that were desirable
to incorporate, such as prescriptive ACIs, but did not at this time given
the state of flux around ldap subentry.  We also felt that ldap subentry
shouldn't be required to implement ldapv3 access control to get acceptance
and timely implementations/vendor products that incorporate the access
control model.  However, we did incorporate the concept of scope into the
ACI definitions.  Likewise, as you read the document, you'll see the
decisions (and why) we made with respect to controlling access to ACI,
alias de-referencing, referrals, and more.

Here's a short summary of the changes:
- BNF per RFC 2234
- Added back multiple list of attributes; removed collections
- updated/expanded set of permissions and their descriptions
- Clarification of interactions of precedences and evaluations
- added access decision algorithm so nothing intuited from examples
- Added strength of authentication option into aci syntax based on ldap bind
- Versioning ldapACI: concluded that a different attribute would be used
     in subsequent RFCs on ldap access control
- Incorporated authmeth id format into subject component of ldapaci (removed
     kerberos format)
- ipAddress format expanded to include domain names and wildcards
- added ability to control access to ACI; removed policy owner
- removed terminology section
- defined ldapACISubEntry to allow specification of any access control 
mechanism
      anywhere in the tree
- addressed how alias de-referencing and referrals work with respect to 
access control
- updated the examples to reflect the BNF
- updated the security considerations sections
- updated/expanded description of the access control model
- Misc cleanup of text

Comments welcome, as always...

Thanks.
Ellen