Subject: [sacm] [draft-ietf-sacm-architecture] Section 3.1.1 Posture Assesment Information Provider (#19)

From: Jim Schaad <[email-masked]>
Date: Tue, 07 Jul 2015 21:33:59 -0700

version -03

In paragraph 3 - The sharing of things spontaneously seems to be problematic from an authorization point of view.  It is one thing to provide data asynchronously from a previous request, where the authorization can have already been checked and another to just start arbitrarily sending data to somebody.  I realize that the latter matches, to a large degree, the case of a Posture Collector sending data to an initial Posture Consumer, but it might be well to separate these two cases deal with them separately.  Are there other cases for the second case that I have missed?

In paragraph 3 - I think you mean based on the former rather than the latter.  Authorization restrictions would be based on the consumer not the provider.

In paragraph 5 - A Provider which is not authorized to provide information does not seem to be a very useful concept.  I suggest deleting "and further, be authorized to do so"  you might add to the end "and for specific consumers"

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-architecture/issues/19

---

From: llorenzin <[email-masked]>
Date: Thu, 23 Jul 2015 01:56:02 -0700

Resolution - expand third paragraph to two paragraphs - one addressing unsolicited / spontaneous publication, the second dealing with requested publication.
A consumer may ask any request; a provider may choose not to respond, or to respond with a subset of information.
P5 comment - no change

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-architecture/issues/19#issuecomment-124026145