Subject: Re: application defined permission

From: "Timothy Hahn" <[email-masked]>
Date: Fri, 9 Mar 2001 15:54:37 -0500

Bruce,

I feel that it is not a good idea to attempt to add in application-defined 
permissions into the LDAP ACI document.

I agree that a well-defined application permission model is a useful 
capability and we SHOULD define such a set of schema and characteristics. 
I just don't think the current LDAP ACI draft is the place to add it.

Regarding permissions for extended operations, I feel that in some cases, 
as Kurt has pointed out, that the existing LDAP ACI permissions can and 
should be used in determining whether the extended operation will be 
allowed or not.  I believe that there are other cases where this may not 
be true.  Further, since extended operations do NOT contain a "base DN" of 
any kind, an extended operation may or may not pertain to any particular 
sub-tree of information.  Thus, trying to "fudge in" extended operations 
permissions into the current LDAP ACI model doesn't seem appropriate 
either.

I think that these topics should be taken up in new internet drafts and 
then refined to RFC status.

Regards,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Endicott/IBM@IBMUS or IBMUSM00(HAHNT)
phone: 607.752.6388     tie-line: 8/852.6388
fax: 607.752.3681

To:     "Kurt D. Zeilenga" <[email-masked]>, Rob Byrne <[email-masked]>
cc:     [email-masked] 
Subject:        Re: application defined permission

At 08:50 AM 3/9/2001 -0800, Kurt D. Zeilenga wrote:

>I concur.  The ACL model should be simple.  This would add
>unnecessary complexity to the specification and implementations.

I don't really see how the proposal that I made is that complex.  You are
just adding an extra possibility that doesn't restrict the operations of
the directory in any way.  If the LDAP server chooses to implement the
application defined permissions (which it doesn't have to), then in
calculating the effective rights the application defined permissions 
should
be taken into account.  This seems pretty simple to me.  I was never 
trying
to say that all LDAP servers had to implement this.  If you don't want to
implement application defined permissions, don't do it.  It's just one
other option for implementors.

I think that limiting the list of permissions to those specifically 
defined
in the acl model document is opening the door for the possibility of
problems down the road.  By building in extensibility, you are making sure
that the protocol and model won't be broken down the road.

>We also use "psuedo" attributes (which don't actually exist)
>to govern access to information not held in any attributes.
>

Are you proposing this as a mechanism to implement application defined
permissions?  I don't understand this.  You give a user the ability to
write to an attribute that doesn't exist, so that when the user tries to
write a value into the attribute, the operation fails?  Can you give more
details?

Thanks... Bruce

==============================================
Bruce Greenblatt, Ph. D.
Directory Tools and Application Services, Inc.
http://www.directory-applications.com

---

From: Bruce Greenblatt <[email-masked]>
Date: Fri, 09 Mar 2001 16:59:11 -0800

>permissions into the LDAP ACI document.

OK.  How about this.  Put in some verbiage to let people know about 
application defined permissions, and extended operation permissions, and 
how they are outside the scope of this model, and are the subject of future 
work.  I would suggest a slight modification of stuff from your note:

"A well-defined application permission model is a useful capability and we 
SHOULD define such a set of schema and characteristics.  However, this 
model is out of scope for this document, as it is only concerned with 
applying access controls to existing LDAP operations.

Extended operations may NOT necessarily contain a "base DN" of any 
kind.  An extended operation may or may not pertain to any particular 
sub-tree of information. Thus, trying to "fudge in" extended operations 
permissions into the current LDAP ACI model doesn't seem appropriate 
either.  This applying permissions to extended operations is also out of 
scope for this document.

Both application defined permissions and extended operation permissions may 
be the subject of future IETF activity."

I will write up a draft on application defined permissions as a separate 
document after the meeting.  Please let me know any discussions that take 
place about application defined permissions at the meeting.  Thanks to 
everyone for taking the time to think about this issue!  I will be thinking 
warm thoughts for you while everyone is in Minnesota!

Bruce