Subject: draft-ietf-ldapext-acl-model-07.txt

From: Ellen Stokes <[email-masked]>
Date: Fri, 02 Mar 2001 14:31:52 -0600

Folks,

Attached is an updated draft of the access control model (document has been 
submitted to
the draft editor to publish under separate email).  Not all comments and 
consensus that has
been reached over the past months is reflected in this draft - I deemed it 
necessary to provide
an update for as much is ready.

This draft (07) reflects a lot of the comments received and resolved over 
the past many months:
- discloseOnError:  changed from server basis to a permission on an entry
- Delete permission: clarified it works on leaf entry (per X.500)
- Rename permission:  re-written per consensus using Chadwick's email
- split ldapACI attribute into subtreeACI and entryACI attributes to 
simplify scoping and inheritance
        per Chadwick email and removed the text on partial inheritance
- Clarified use of “[all]” and “[entry]” wrt subtree scope
- Authentication level:  clarified how it works with deny; added anonymous 
and none levels; stated behavior when
        no authlevel is specified
- Dependency on ldapSubEntry specification? yes, but only if you need DIT 
to hold more than one access control model
- Specificity precedence: ipaddr/authzID/this/role/group/subtree/public; 
default deny at very bottom
- Misc clarifications, editorials, etc (e.g. add, import, export perms; 
empty grant list; subject definitions)
- Removed GetEffectiveRights extended operation - we believe you can do 
everything with the control
- negate syntax for disallowing attributes in ldapACI – consensus was don’t 
do ; push to later
- specification of default ACI per object class – push to later?
- ipv6 addresses as ip addresses
- clarified in bnf what perms are for attrs and for entries
- updated examples for better model coverage
- removed operational semantics section; section 5 contains the right 
material per operation

The following list of items still needs to be reflected in the next draft 
(version 08):
- Search permission (section 5.2):  revisit/update permissions b, r, 
s::  browse meant for traversal permission; if
        specify base level DN, it overrides specification of browse; use 
returnDN to allow read of entry; browse only
        applies to search; move t in search operation to main search 
section - further discussion needed for use of
        s, r, b, t; mention matchedDN in operations other than search (e.g. 
name resolution)
- Use of filters in ACI? – look at adding…filter behaves as specified in 
ldap filter spec
- getEffectiveRights:  address what if not sufficient rights on ldapACI? 
(get rights based on the bind authzID) - need
         proxy permission? – permission for entries to be proxied
- equality matching rule for entryACI and subtreeACI– see Steven Legg’s 
component matching work
- permission extensibility for extended operations – use combination of 
perms from existing set?
- ACI binary representation (section 4.1.2) to match the BNF (section 
4.1.1) for <rights>
- syntax and matching rule clauses of entryACI and subtreeACI definitions 
in section 4 to match section 4.1.2

Ellen