Subject: RE: Proposed charter and milestone revision for CAT-WG

From: "Linn, John" <[email-masked]>
Date: Thu, 13 May 1999 16:54:17 -0400

Frank, all:

I'd like to hear comments from the group on this.  My current sense is that
we have declared interest within the WG in the general area of authorization
interfaces, and have had useful exploratory and informative discussions, but
that we don't have clear consensus to advance existing proposals towards
standardization as they stand.  Since we've had very limited discussion on
the list between meetings, it's not clear to me that we've demonstrated the
level of progress and commitment which would support proposing a contract to
the IESG in the form of chartered milestones. I believe we need to make an
explicit decision as to whether and how to proceed, and that we should seek
to be well along that decision path as of the upcoming Oslo meeting. Until
and unless the group agrees on and actively supports an approach, and we're
confident that its discussion and documents can proceed in a timely fashion
suitably coordinated to support other authorization-concerned WGs (a
significant commitment), my own opinion is that we shouldn't propose to
undertake further work items and milestones in this area. What do others
think?

--jl

> -----Original Message-----
> From: Frank Siebenlist [mailto:[email-masked]]
> Sent: Thursday, May 13, 1999 1:11 PM
> To: Linn, John
> Cc: 'CAT-WG List'
> Subject: Re: Proposed charter and milestone revision for CAT-WG
> 
> 
> John,
> 
> The statement: "Authorization interfaces are currently being 
> considered as a related area for follow-on work" doesn't 
> sound very convincing...
> 
> Understand that authorization is being dealt with in a number 
> of other working groups, but if we believe that authorization 
> services should be an integral part of the CAT working 
> group's charter, you may want to add them to the goal statement:
> 
> "The goal of the Common Authentication Technology (CAT) 
> Working Group is to
> provide distributed security services (including 
> authentication, integrity, confidentiality, and 
> authorization) to a variety of protocol callers in a manner 
>                  ^^^^^^^^^^^^^^^^^
> which insulates those callers from the specifics of 
> underlying security mechanisms."
> 
> 
> If we don't want to do that, we should ask the IESG for 
> guidance and find a "real" home for authorization services.
> 
> -Frank.
> 
> -- 
> Frank Siebenlist              DASCOM, Inc. 
> Chief Architect               3004 Mission Street
> Email: [email-masked]       Santa Cruz, CA 95060, USA
> Phone: +1 831/460-3600        Fax: +1 831/460-0255
> 
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Sam Hartman <[email-masked]>
Date: 16 May 1999 10:10:44 -0400

>>>>> "Linn" == Linn, John <[email-masked]> writes:

    Linn> Frank, all: I'd like to hear comments from the group on
    Linn> this.  My current sense is that we have declared interest
    Linn> within the WG in the general area of authorization
    Linn> interfaces, and have had useful exploratory and informative
    Linn> discussions, but that we don't have clear consensus to
    Linn> advance existing proposals towards standardization as they
    Linn> stand.  

I think that CAT has been looking at authorization differently than
most of the other groups I have seen that are dealing with
authorization.  The AAA working group has an incredibly rich
definition of authorization, which while perhaps appropriate for
remote access and access to network service is probably too complex
for distributed applications.  While they hope to look at all the
issues and provide a system that would be useful for all consumers
including distributed applications, I do not think they will be
successful.  I'm a bit behind on reading the mail for AAA, so I may
not be completely correct on the current state.

It seams to me that a general authorization framework that provided a
solution in the authorization space similar to the solution that
GSSAPI provides in the authentication space would be useful.  I like
this type of solution better than mechanisms that require
the application to structure its authorization data in a particular way.

That said, Mike Swift did bring up a significant objection to GAA a
while back.  If an application cannot reasonably be written without
knowledge of the underlying mechanism, then it's not clear what value the API has.  

I believe that such a solution would only be worth pursuing in the CAT
context if it actually did provide a framework so that application
vendors could plug in authorization mechanisms much as they now can
plug in authentication mechanisms.  I do not believe that CAT should
get involved in designing a particular authorization mechanism outside
the scope of a framework.
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]