Subject: please publish - draft-ietf-ldapext-acl-model-08.txt

From: Ellen Stokes <[email-masked]>
Date: Fri, 29 Jun 2001 11:05:39 -0500

Internet Drafts Editor,
Please publish the attached draft:   draft-ietf-ldapext-acl-model-08.txt
Thanks.

ldapext working group:

Please find attached the next version of the ldap access control model.
The following is a summary list of the changes we made in this draft
based on mailing list comments, discussions, etc:
- list of what is out of scope for the model
- corrected and consistent ABNF and ASN.1
- authentication level is now a set of levels similar to what is in X.500; 
it is always
     an explicitly required part of an ACI (see security considerations 
section)
- ipAddress and DNSName are retained as subjects (see security considerations
     section)
- a few new permissions
	u = unveil (disclose on error)
	p = search filter (presence only)
	g = get effective rights
- expanded section on access control decision making that discusses
      applicability rules, precedences, inheritance, and the algorithm;
      examples of applying the algorithm to make an access control decision
- added lots more examples in section 8 to cover interaction among ACI, use
     of ipAddress in ACI, and use of authnLevel in ACI
- revision of getEffectiveRights control for simplicity
- expanded security considerations section
Please recall that the goal here from the last IETF meeting is to do a last 
call
on this draft before the August meeting.  So please review so we can make a
last call happen real soon (remember that IF we need to do another revision
before the last call, the draft cutoff is July 20).
Please send comments to the list.
Thanks.
Ellen, Rob, and Rick