Subject: schema-09 and RFC: avoiding collisions in RoleName namespace

From: "Larry S. Bartz" <[email-masked]>
Date: Mon, 08 Jan 2001 08:47:06 -0500

I suggest this (or similar) verbiage be added to schema-09 and
subsequent documents, possibly in "5.3. The Class policyRule",
following the ABNF for the policyRoles attributetype. Alternatively,
this verbiage could be included as an appendix entitled "Avoiding
Collisions in the RoleName Namespace". Such an appendix could be 
referenced from "5.3. The Class policyRule".

The RoleName substring component of the policyRoles attribute must be
drawn by implementers from an unregulated namespace. Since the
namespace is unregulated, there is a potential for namespace collisions.
The same RoleName could be associated with entirely different semantics
in two or more implementations. The negative consequences of these
namespace collisions could be manifested in several situations,
including:
when policy information from two or more unrelated Directory
implementations
is accessed and evaluated simultaneously; when policy infomation from
two 
or more federated Directory instances is evaluated in the federated
context; when policy information is replicated from its initial
Directory
implementation to another.

Implementers whose policy information may be subject to the potential
for namespace collision SHOULD devise and follow a strategy of collision
avoidance in the RoleName namespace. Implementers MAY create values for
the RoleName substring which consist of the descriptive and functional
name of the role (the "natural" role name), then prepend the natural
role name with a string which guarantees uniqueness to their
implementation.
Choosing an interCap style for the resulting string can promote
readability.
 
For example, policy administrators at bigcorp.com and tinycorp.com each
create a RoleName "firewall". While the term "firewall" may appear to
offer
unambiguous semantics, it is entirely possible that the two policy
admins
ascribe some conflicting properties to the "firewall" role. When bigcorp
and tinycorp interoperate in Policy, the namespace collision produces
negative consequences. In order to collision-proof the RoleName, the
policy
admins should create and implement RoleNames "comBigcorpFirewall" and
"comTinycorpFirewall", respectively.
     
--
#::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|
# Larry Bartz                           |                              |
#  [email-masked]      | Ooo, ooo,                    |
#                                       | Ooo, ooo, oooooo!            |
#                                       | I've got a gnu attitude!     |
#  voice (317) 226-7060                 |                              |
#  FAX   (317) 226-6378                 |                              |
#::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::|

---

From: "Robert Moore" <[email-masked]>
Date: Mon, 8 Jan 2001 10:25:57 -0500

Larry,

I have no problem adding some text along these lines, if
the rest of the WG thinks it would be valuable.  Since the
possibility of collisions in policyRoles values has nothing
to do with storing policy in an LDAP-accessible directory,
the text you're interested in should really have gone into
the PCIM, not PCLS.  But since it's not in the PCIM, PCLS
is as good a place as any for it.

Would other WG members like to see Larry's text included
in PCLS-09?

Regards,
Bob

Bob Moore
IBM Networking Software
+1-919-254-4436
[email-masked]

"Larry S. Bartz" <[email-masked]>@raleigh.ibm.com on
01/08/2001 08:47:06 AM

Please respond to "Larry S. Bartz" <[email-masked]>

Sent by:  [email-masked]

To:   IETF Policy WG LIST <[email-masked]>
cc:
Subject:  schema-09 and RFC: avoiding collisions in RoleName namespace

---

From: "Wijnen, Bert (Bert)" <[email-masked]>
Date: Tue, 9 Jan 2001 11:54:29 +0100

Comments inline

> ----------
> From: 	Robert Moore[SMTP:[email-masked]]
> Reply To: 	Robert Moore
> Sent: 	Monday, January 08, 2001 4:25 PM
> To: 	Larry S. Bartz
> Cc: 	IETF Policy WG LIST
> Subject: 	Re: schema-09 and RFC: avoiding collisions in RoleName
> namespace
> 
> Larry,
> 
If we believe it belongs on PCIMMM, then another way to achieve
this is that we put it on our list of edits for the next rev of PCIM
(i.e. whenever we go to DS or recycle at PS).

Bert

---

From: "Joel M. Halpern" <[email-masked]>
Date: Tue, 09 Jan 2001 10:02:29 -0500

Another place to capture this (at least for the time being) would be in the 
PCIM extensions draft.
Yours,
Joel M. Halpern