Subject: ACL all entry attribute keyword

From: Sanjay Panwar <[email-masked]>
Date: Fri, 09 Mar 2001 12:50:56 -0800

Question on draft-ietf-ldapext-acl-model-07.txt
-----------------------------------------------------

WRT attr options
               attr = "[all]" / "[entry]" / (attribute *("," attribute))

Is it necessary to have two different keywords to target Entry and All
attributes, since we already have separate set of permissions for entry
and attributes.

Is it not sufficient to have only one  keyword, lets call it “[all
entry]”,  to target both entry and its attributes. Permission determines
whether it can be applied to an entry or attribute as illustrate below.

  subtreeACI: grant:o # [all entry] # role:cn=SysAdmin,o=Company
                  ; Applies to all attributes as o is attribute specific
permission
  subtreeACI: grant:d # [all entry] # role:cn=SysAdmin,o=Company
                 ; Applies to the entry as d is entry specific
permission

 With the existing scheme it is possible to define following ACIs, which
do not have any meaning.

  subtreeACI:grant:o#[entry]#role:cn=SysAdmin,o=Company
  subtreeACI:grant:d#[all]#role:cn=SysAdmin,o=Company

- Panwar

---

From: Ellen Stokes <[email-masked]>
Date: Mon, 12 Mar 2001 15:53:46 -0600

Sanjay,

Previously we agreed to annotate the BNF to state which perms applied
to entries and which to attributes.  For clarity, I've reworked the BNF
(just section 4.1.1 so far) to remove the annotation and state clearly in BNF.

Here it is (and I hope I got it right given I'm not a BNF expert)...

******start BNF***********

  entryACI = rights "#" attr "#" subject

  subtreeACI = rights "#" attr "#" subject

  rights = (("grant:" / "deny:") permissions) /
           ("grant:" permissions ";deny:" permissions)

  permissions = entryPerm ("," entryPerm)* "#[entry]" /
                attrPerm ("," attrPerm)* "#[all]" /
                attrPerm ("," attrPerm)* "#" (attribute ("," attribute)*)

  entryPerm = "a" / ; add
              "d" / ; delete
              "e" / ; export
              "i" / ; import
              "n" / ; renameDN
              "b" / ; browseDN
              "t"   ; returnDN

  attrPerm = "r" / ; read
             "s" / ; search
             "w" / ; write (mod-add)
             "o" / ; obliterate (mod-del)
             "c" / ; compare
             "m"   ; make

  attribute = ; OID syntax (1.3.6.1.4.1.1466.115.121.1.38)
              ;     from [ATTR]

  subject = ["authnLevel:" authnLevel ":"]
              (("authzID-" authzID) /
              ("role:" dn) /
              ("group:" dn) /
              ("subtree:" dn) /
              ("ipAddress:" ipAddress) /
              "public:" /
              "this:")

  authnLevel = "any" /
               "simple" /
               sasl /
               "none" /
               "anonymous" /

  sasl = "sasl:"
         ("any" /
         mechanism)

  mechanism = ; sasl mechanism from 4.2 of [LDAPv3]

  authzID = ; authzID from [AuthMeth] repeated below
            ;    for convenience

  authzId = dnAuthzId / uAuthzId

  ; distinguished-name-based authz id.
  dnAuthzId  = "dn:" dn

  dn = utf8string ; with syntax defined in [UTF]

  ; unspecified userid, UTF-8 encoded.
  uAuthzId   = "u:" userid
  userid     = utf8string ; syntax unspecified

  ; IP address
  ipAddress   = IPv6address | printableString
                ; printableString to use a wildcard
                ;    domain name such as *.airius.com
                ;    to specify a specific DNS domain

  ; following is excerpted from [IPV6]
  IPv6address = hexpart [ ":" IPv4address ]
  IPv4address = 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT
  IPv6prefix  = hexpart "/" 1*2DIGIT

  hexpart = hexseq | hexseq "::" [ hexseq ] | "::" [ hexseq ]
  hexseq  = hex4 *( ":" hex4)
  hex4    = 1*4HEXDIG

  printableString ; printableString syntax from [ATTR]

*******endBNF***********

Ellen

At 12:50 PM 3/9/2001 -0800, Sanjay Panwar wrote:

>Is it not sufficient to have only one  keyword, lets call it "[all
>entry]",  to target both entry and its attributes. Permission determines

---

From: Sanjay Panwar <[email-masked]>
Date: Mon, 12 Mar 2001 16:46:33 -0800

Ellen,

I am not clear on the need of having two distinct keywords 'all' and 'entry'. In
fact the 'entry'  keyword can be avoided all together because permissions specific
to an entry can only be applied on the entire entry and not on its parts. Am I
missing something ?

- Panwar

---

From: Ellen Stokes <[email-masked]>
Date: Tue, 13 Mar 2001 08:30:51 -0600

Sanjay,
Your statement is true.  But for symmetry in parsing and ease
of quickly focusing on whether it is attribute or entry, we defined
the access control attribute the way it is.  I don't see any harm
in leaving it the way it is (especially for ease of use).
Ellen

---

From: Sanjay Panwar <[email-masked]>
Date: Thu, 15 Mar 2001 09:13:20 -0800

Ellen,

I see a need for the ability to target object classes in the same fashion as we can
target attributes. Consider the following schema.

                                       o=a
                       ou=ab                  cn=san
             ou=abc       cn=pan
      ou=abcd

 1) How can one specify a ACI at o=a, granting 'a' permission for objects of type
organizationalPerson only. I guess with the current definition it can be achieved
by specifying Mandatory attributes of organizationalPerson. But it is not a
foolproof mechanism. What if two object class have the same set of mandatory
attributes.
2) How can one specify a ACI at o=a, permitting import/export of organizationalUnit
only. e.g. Move ou=abcd,ou=abc,ou=ab,o=a to ou=abcd,ou=ab,o=a.

It should be possible to define ACI as per following proposed BNF.
Example ACI
    1) entryACI =grant:a # OID.organizationalPerson # role: cn=admin
            or
       subtreeACI =grant:a # OID.organizationalPerson # role: cn=admin
    2) subtreeACI = grant:e,i # OID.organizationalUnit # role: cn=admin

Proposed BNF. Basic idea is that rights or permissions govern whether the ACI
applies to Entry as a whole or attributes. Again I am not an expert in writing BNF
but I hope that BNF conveys the intent.

   entryACI = rights "#" TargetElement "#" subject
   subtreeACI = rights "#" TargetElement "#" subject

   rights = (("grant:" / "deny:") permissions) /
            ("grant:" permissions ";deny:" permissions)
   permissions = objPermission / attrPermission
           ;Ideally I will want to derive these rule name from ElementType
   objPermission = "a" / ; add
               "d" / ; delete
               "e" / ; export
               "i" / ; import
               "n" / ; renameDN
               "b" / ; browseDN
               "t"   ; returnDN
   attrPermission = "r" / ; read
              "s" / ; search
              "w" / ; write (mod-add)
              "o" / ; obliterate (mod-del)
              "c" / ; compare
              "m"   ; make

   TargetElement = [all] / (ElementType *(,ElementType))
              ; ElementType can be either attr or obj in a single definition but
not a combination of both
   ElementType = attr / obj
   attr = ;OID syntax (1.3.6.1.4.1.1466.115.121.1.38)from [ATTR]
   obj = ;OID object class name

   authnLevel = "any" /
                "simple" /
                sasl /
                "none" /
                "anonymous" /

   sasl = "sasl:"
          ("any" /
          mechanism)

   ; IP address

-----------------------------------------------------------------------------------

-Panwar

---

From: Ellen Stokes <[email-masked]>
Date: Sun, 18 Mar 2001 22:30:43 -0600

Sanjay,

The topic you propose is to add access control based on object class.
This topic was discussed many months ago on the mailing list and it
was decided to postpone.

I suggest that this is a potential item under the evolving schema work.
This way one could apply a default ACI when an object class is
instantiated, for example.

Ellen