Subject: Re: anonymous & none in the ACM (Was: Comments Access Control Model - authentication levels 2)

From: [email-masked]
Date: Mon, 9 Apr 2001 12:52:16 -0500

All,

>Just to try to close this one item, is there anyone who thinks we need
>to differentiate in the ACM between, in the terms of Ellen's very last
>BNF, "anonymous" and "none" ?

>>    authnLevel = "none" /            ; from X.500:  name but no password,
>> same as LDAPBIS unauthenticated
>>                        "anonymous" /   ; from LDAP:  no name and no
password

>Rick says he doesn't care, Kurt says X.500 says they are the same thing
>(from an access control point of view).
>They seem pretty similar to me.

>If we do collapse them both then I would suggest "unauthenticated" as a
>good name for this kind of authentication level--looks like that's
>consistent with ldapbis teminology.

X.500 was designed before privacy became an issue as big as it is today.
Certainly "anonymous" and "unauthenticated" DO NOT mean the same thing
in all cases -- for example if I use a debit (ATM) card at my grocery
store, from
the viewpoint of the store I am anonymous (they don't learn my identity, it
isn't printed
on the card, etc....), and yet I certainly am authenticated, as the holder
of checking account
number XXXXXXXXXXXXX before that account is debited (that's why I supply
the PIN).

In lots of cases it will be desirable to authenticate the user, or some
attribute of the user,
and then throw away the identity in order to preserve privacy.

--bob

Bob Blakley
Chief Scientist
Enterprise Solutions Unit
Tivoli Systems, Inc. (an IBM Company)

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 09 Apr 2001 11:21:29 -0700

At 12:52 PM 4/9/01 -0500, [email-masked] wrote:
>the viewpoint of the store I am anonymous (they don't learn my identity,

Actually, the store does know your name... it might even
be printed on your receipt... my local store actually
makes a point in thanking customers by name after they
use their bank card.

Kurt

---

From: robert byrne <[email-masked]>
Date: Tue, 10 Apr 2001 11:13:38 +0200

Bob,

I understand your use of the word "anonymous".  However, that's not the
way Ellen was using it in her BNF--it seems clear that by "anonymous"
she means a requestor who is not authenticated at all, not that the
requestor did authenticate but then had his identity thrown away.

I guess the LDAP version of your store customer would be a requestor who
authenticated using say SASL CRAM-MD5, but attached a proxy
authorization control with an authorization identity of "".

I think the ACM could probably accomodate such requestors with a subject
like this:

	subject = authnlevel: sasl: DIGEST-MD5 : public

In other words, for the purpose of evaluating this aci we do require the
requestor to have authenticated using SASL DIGEST-MD5, but we do not
require him to be authenticated with any _particular_ identity.

Rob.