Subject: Re: ACM & Replication (Was: LDAPEXT Minutes)

From: [email-masked] (Richard V Huber)
Date: Tue, 17 Apr 2001 19:16:59 -0400

: Are you saying here that LDAP ACM would be used to control what
: was replicated between servers?  That seems presumptive.

No, replication agreements control what is replicated among servers.

All I'm saying is that the format specified by the ACM for representing
access control information on the wire is also the format LDUP should
use to transport access control information during replication.  So
there should be a few additions to the ACM draft to clarify this
additional intended use.

Rick Huber

: From [email-masked] Tue Apr 17 18:50:59 2001
: Return-Path: <[email-masked]>
: X-Sender: [email-masked]
: To: [email-masked] (Richard V Huber)
: From: "Kurt D. Zeilenga" <[email-masked]>
: Subject: Re: ACM & Replication (Was: LDAPEXT Minutes)
: Cc: [email-masked], [email-masked]
: Mime-Version: 1.0
: 
: At 02:00 PM 4/17/01, Richard V Huber wrote:
: >The main replication-related change to the ACM draft is to make it
: >clear that the ACM applies to wire-line flows of data being
: >replicated.
: 
: Are you saying here that LDAP ACM would be used to control what
: was replicated between servers?  That seems presumptive.
: 
: >Ellen Stokes agreed to add that to the ACM draft.  I'll propose
: >specific wording if needed.
: 
: Please do. That would allow some WG discussion of the specifics.
: I certainly not sure what type of clarification you trying to
: make.
: 
: I note I belief that the section paragraph of the Introduction and
: the second paragraph of the Security Considerations were pretty
: clear as how LDAP replication issues related to the LDAP ACM
: are to be addressed.  That is, such issues are "out of scope".
: I would certainly question any attempt to bring them into scope.
: 
: Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 17 Apr 2001 16:27:24 -0700

>there should be a few additions to the ACM draft to clarify this

It seems to me that the need for this clarification is this
statement in Section 2:
  No mechanism is defined in this document for storage of
  access control information at the server beyond indicating
  that the attribute holding access control information is an
  operational attribute.

This statement I find odd as LDAP doesn't define any mechanism
for storage of any information beyond that of the data model.
Like any other attribute, the server is free to store it as it
pleases.

I think it unwise to add a replication specific clarification.
What's needed is an data model clarification... that is, servers
MUST implement ldapACI and other attributes in accordance to
the X.500 data and service model per RFC 2251, 3.3.

Kurt