Subject: expansion of groups/roles/subtree subjects in LDAP ACM

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 05 Jul 2001 12:58:23 -0700

How are exceptional conditions in expanding
groups/roles/subtrees to be handled?  In particular,
what is the ACM behavior when the groups/roles/subtrees
cannot be fully expanded and the requestor's DN is not
found in the partial set of DNs?

Kurt

---

From: Ryan Moats <[email-masked]>
Date: Thu, 5 Jul 2001 16:17:56 -0500

> found in the partial set of DNs?

Well as an initial (not perfect) suggestion I would opt for
notifying via the log system that the group/role/subtree
has not been fully expanded and that access has been denied
because the DN is not in the partial set.

Ryan

---

From: "John Strassner" <[email-masked]>
Date: Thu, 5 Jul 2001 14:00:40 -0700

agreed, except that noting in the log system that the group/role/subtree
has not been fully expanded **may** give, in some cases, more information
than needed and be a start in compromising security.

regards,
John

-----Original Message-----
From: Ryan Moats [mailto:[email-masked]]
Sent: Thursday, July 05, 2001 2:18 PM
To: Kurt D. Zeilenga
Cc: [email-masked]
Subject: Re: expansion of groups/roles/subtree subjects in LDAP ACM

Ryan

---

From: robert byrne <[email-masked]>
Date: Mon, 09 Jul 2001 16:25:27 +0200

Kurt,

I think what's needed here is for the draft to specify that, if the
evaluation of any part of the subject fails, then the subject part of
that aci does not apply.  So we can change the intro to 4.3.2.4 to
something like:

"4.3.2.4  Applicability Rules for Subjects

Call the subject portion of the ACI in question aciSubject.  Then to
determine if aciSubject applies to requestorSubject we apply the
following rules.  In the case where the server fails to evaluate a
rule and so fails to fully confirm that aciSubject applies, then
aciSubject does not apply."

Rob.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 09 Jul 2001 07:30:48 -0700

>aciSubject does not apply."

I believe that rules for expansion of subjects should be
consistent with X.501(93), 16.4.2.5 "Determining group membership".
In particular,
  a) A DSA is not required to perform a remote operation to determine whether the
  requestor belongs to a particular group for the purposes of Basic Access Control.
  If membership in the group cannot be evaluated, the DSA shall assume that the
  requestor does not belong to the group if the ACI item grants the permission sought,
  and does belong to the group if it denies the permission sought.

 NOTE 1 – Access control administrators must beware of basing access controls on membership
 of non-locally available groups or groups which are available only through replication (and which
 may, therefore, be out of date).
 NOTE 2 – For performance reasons it is usually impractical to retrieve group membership from
 remote DSAs as part of the evaluation of access controls. However, in certain circumstances it
 may be practical, and a DSA is permitted, for example, to perform remote operations to obtain
 or refresh a local copy of a group entry or use the Compare operation to check membership
 prior to applying this clause.

I believe (b) makes sense as well, but that's another thread.

---

From: Mark Davidson <[email-masked]>
Date: Mon, 09 Jul 2001 15:49:28 +0100

> that aci does not apply.  So we can change the intro to 4.3.2.4 to

I think that when evaluation of any part of the subject fails the
server must act in a fail safe way. This means that access must be
denied.

So 4.3.2.4 intro should read:

Call the subject portion of the ACI in question aciSubject. In the case 
where the server fails to evaluate a rule and so fails to fully confirm
that aciSubject applies, then access is denied. Then to determine if 
aciSubject applies to requestorSubject we apply the following rules:"

Mark