Subject: Re: [sacm] [draft-ietf-sacm-architecture] Section 3.1.3 - Controller - Authorization (#27)

From: Nancy <[email-masked]>
Date: Sat, 10 Oct 2015 18:24:10 -0700

I have tried to make this more explicit by now updating the Authorization description in 5.1 as:
The restriction of Posture Assessment Information sharing
between the Consumers and Providers. At minimum, a management function must
define
      the necessary policies to control what Providers can publish and Consumers to accept. The Controller is the authority for the type of Posture Information that a Provider can publish and a Consumer can accept.  If a Controller is a Broker, then it may only grant authorization to the capabilities requested by the Provider or Consumer.  When acting as a Proxy, as part of its authorization, the Controller may further obscure or block information being shared by a Provider as it distributes it to a Consumer.  Similarly, a Repository may block information as recieved by the Provider and pass to the Consumer and to its storage the resulting authorized information. A Provider may also enforce its own authorization based upon its connection to a Controller; though, in the case where an application includes both the Provider and Controller roles, it can choose to implement all authorization on the Controller.  Similarly, a Consumer may enforce its own authorization of what data it can re
 ceive based on the Controller (or Provider) it is communicaticating with; in the case where an application includes both the Consumer and Controller roles, it can choose to implement all the authorization on the Controller.

Comments and suggestions?
   Nancy

---
Reply to this email directly or view it on GitHub:
https://github.com/sacmwg/draft-ietf-sacm-architecture/issues/27#issuecomment-147144095