Subject: [XCON] CPCP issue 2: Namespaces

From: [email-masked]
Date: Thu, 20 May 2004 18:38:17 +0300

We envisioned that privileges will be assigned to users according to the schema. So, if I want to give you permission to add people to the dial-out list, then in effect I am giving you write permission to that part of the XML document. We therefore divided the XML schema into multiple schemas where each part can be viewed as a privilege. We also envisioned that a second XCAP usage document will be created containing the privileges gives to participants (and others) of the conference. 3 pieces of information: URI of the XCAP document that privileges are being given for, the users that are being granted privileges, and the namespaces that those users can manipulate elements in (the privilege).

We now think it can be done using XPATH and therefore will remove the multiple namespaces. Multiple namespaces makes the XML document too confusing.

I propose removing the multiple namespaces and collapsing the whole XML definition for CPCP into one namespace.

Comments?

Regards,
Hisham

_______________________________________________
XCON mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/xcon

---

From: Adam Roach <[email-masked]>
Date: Thu, 20 May 2004 17:16:43 -0500

[not as chair]

Just to make sure I understand the proposal:

Your plan is to grant users privileges to particular
XCAP URIs. Users will be able to modify anything
present at that point in the XCAP tree or lower. In
other words, groups of privileges are grated based
on the tree structure of the document, instead of
namespaces.

I *think* that this should be okay, because of the way
that XCAP documents are structured. Currently, the
namespaces line up completely with the first-level
subtrees (that is, anything attached directly to the
top-level <Conference /> element).

The only think I'd want to be careful of is making certain
that we've thought through possible future extensions
that might not fit into this model. Is it reasonable to
assume that all future CPCP document extensions will
be suited to breaking up modification permissions by subtree?

/a

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Thursday, May 20, 2004 10:38
> To: [email-masked]
> Subject: [XCON] CPCP issue 2: Namespaces
> 
> 
> We envisioned that privileges will be assigned to users 
> according to the schema. So, if I want to give you permission 
> to add people to the dial-out list, then in effect I am 
> giving you write permission to that part of the XML document. 
> We therefore divided the XML schema into multiple schemas 
> where each part can be viewed as a privilege. We also 
> envisioned that a second XCAP usage document will be created 
> containing the privileges gives to participants (and others) 
> of the conference. 3 pieces of information: URI of the XCAP 
> document that privileges are being given for, the users that 
> are being granted privileges, and the namespaces that those 
> users can manipulate elements in (the privilege).
> 
> We now think it can be done using XPATH and therefore will 
> remove the multiple namespaces. Multiple namespaces makes the 
> XML document too confusing.
> 
> I propose removing the multiple namespaces and collapsing the 
> whole XML definition for CPCP into one namespace.
> 
> Comments?
> 
> Regards,
> Hisham
>

---

From: [email-masked]
Date: Fri, 21 May 2004 09:19:09 +0300

Of course this was just a proposal. Another way of doing it is semantically: You define an XML schema that assigns privileges to users semantically.

Something like

<xcap-doc>http://xcap.example.com/services/conference/users/bob/conference1.xml</xcap-doc>
   <user>sip:[email-masked]</user>
       <privileges>
          <allow-ACL-manipulation/>
       </privileges>

The idea with the syntactic approach of using XPATH expressions was to make the solution for XCAP XML document access generic.

Anyway, the issue at hand now is do we collapse all the namespaces defined now into one or not. I think we should.

Regards,
Hisham

> From: ext Adam Roach [mailto:[email-masked]]
> Sent: 21.May.2004 01:17
> To: Khartabil Hisham (Nokia-TP-MSW/Helsinki); [email-masked]
> Subject: RE: [XCON] CPCP issue 2: Namespaces
> 
> 
> [not as chair]
>

---

From: Adam Roach <[email-masked]>
Date: Fri, 21 May 2004 14:17:02 -0500

[email-masked] [mailto:[email-masked]] wrote:

> Anyway, the issue at hand now is do we collapse all the 
> namespaces defined now into one or not. I think we should.

I agree that such a design seems simpler. I just want
to make sure that we've considered all of the potential
ramifications.

/a

---

From: Alan Johnston <[email-masked]>
Date: Mon, 24 May 2004 08:07:19 -0500

Hisham,

I don't mind so much how authorization is done, but I do think that we need 
to address the authorization issue in the CPCP XCAP document.  The base 
XCAP spec allows the default to be that only creator of the document can 
read/write/modify their own document, which fits with the "per user 
configuration data" model.    For CPCP usage, it is explicitly *not* per 
user, it is per conference, and needs to have per user based authorization 
rules.

One authorization model is to have it URI based.  Another would be to have 
it role-based (conference creator, participant, panelist, etc.)  Another 
model I have thought about is an approval-based mechanism similar to the 
way floor control requests are reviewed and granted.  I'm not sure there is 
merit in the idea so I'm interested in everyone's opinions.  A participant 
would, for example, request that a participant be added to the dial out 
list.  The request would be pending until the conference owner approved the 
request.

If anyone thinks this is a useful model, we can talk about mechanisms for this.

Thanks,
Alan Johnston
MCI
sip:[email-masked]