Subject: [XCON] Roles in the data model

From: "Oscar Novo" <[email-masked]>
Date: Wed, 5 Dec 2007 19:28:05 +0100

Continuing yesterday's discussion about roles...

I still don't see the utility to define some tokens in the data model. I
really think the definition of those roles will depend very much of the
definition of the policy in the data model. If the data model defines a
bunch of tokens without defining the semantic of them it can cause big
confusion for many reader. The definition of those tokens will have
implicit a semantic. For instance, the token 'observer' has a semantic
implicit but I'm sure that semantic differs from different people. 

My proposal here is to work on this problem in the policy document or in
a different document. If we decide to work in a different document there
is a very old document
(http://tools.ietf.org/id/draft-morgan-xcon-roles-00.txt) which tries to
define the role semantic in XCON. I think that document could be a base
to start discussing about roles rather than the data model.

If the WG still thinks is essential the definition of the roles in the
data model I would suggest the definitions of the roles to be numerical
rather than textual to avoid semantic conflict. The roles definition
could be only simple integers starting from '0', having the '0' role
more permissions than the '1' role. 

Comments?

Oscar  

_______________________________________________
XCON mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/xcon

---

From: Lorenzo Miniero <[email-masked]>
Date: Wed, 5 Dec 2007 19:58:25 +0100

I'm not sure an integer like that would solve the problem... A might have more
permissions upon X than B, but B might have more permissions upon Y than A. It
surely works if we consider that participant < moderator < administrator, but
there could be fuzzy roles in between.

Lorenzo

-- 
Lorenzo Miniero, Junior Researcher
Dipartimento di Informatica e Sistemistica
Università degli Studi di Napoli "Federico II"
Via Claudio 21 -- 80125 Napoli (Italy)
Phone: +390817683821 - Fax: +390817683816
Email: [email-masked]

> more permissions than the '1' role. 

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

---

From: "Oscar Novo" <[email-masked]>
Date: Wed, 5 Dec 2007 19:48:23 +0100

Hi,

In my presentation yesterday I didn't express myself in a proper way and
many of you got confuse about the persistent information problem.
Actually the problem is very simple. A user in a conference is mapped
using the 'unique conference user identifier' (XCON_USERID). A user can
have a different XCON_USERID for every conference he is involve. As you
know, now the data model stores some persistent information: nickname,
name and e-mail.    

My first question was: Is the XCON_USERID a temporal identifier? I mean,
when I connect to a conference I get one XCON_USERID. If I decide to
disconnect myself from my conference and connect again later I will get
the same XCON_USERID or different one?   

My second question was: which method shall we use to map the persistent
information store in the data model with the non-persistent information?
(this is related to the first question)  Is it ok if we map one nickname
with several XCON_USERIDs? 

My last question: what other persistent information you think we should
store in the data model rather than nicknames, user's name and e-mail?

Cheers,

Oscar

---

From: "Mary Barnes" <[email-masked]>
Date: Wed, 5 Dec 2007 13:08:56 -0600

I think at a minimum we should at least be defining <roles> in the same
manner that was done in the SIP conference event package:

5.6.3.  <roles>

   This element MAY contain a set of human-readable strings describing
   the roles of the user in the conference.  Note that this information
   is applicable for human consumption only.  This specification does
   not define the set of possible conferencing roles or the semantics
   associated with each.  It is expected that future conferencing
   specifications will define these and the corresponding schema
   extensions, as appropriate.

Then in the schema:
     <!--
         USER ROLES TYPE
      -->
      <xs:complexType name="user-roles-type">
       <xs:sequence>
        <xs:element name="entry" type="xs:string"
         maxOccurs="unbounded"/>
       </xs:sequence>
       <xs:anyAttribute namespace="##other" processContents="lax"/>
      </xs:complexType>
      <!-- 

I find it very disturbing that we're doing the "future conferencing
specifications" referenced in RFC 4575 yet we aren't able to define some
reasonable strings.  

In addition, not defining roles in the basic data model is inconsistent
with the framework where we define role as the following and state that
a default role will always exist:

Role: A role provides the context for the set of conference
      operations that a participant can perform.  A default role (e.g.,
      standard conference participant) will always exist, providing a
      user with a set of basic conference operations.  Based on system
      specific authentication and authorization, a user may take on
      alternate roles, such as conference moderator, allowing access to
      a wider set of conference operations.

In addition, there are many, many references to roles in the framework.
Certainly, if there's consensus, I can remove all of them or make
appropriate notes that roles are entirely defined in the policy solution
which is FFS. But, I think that leaves some fairly large conceptual gaps
in the framework, particularly given that the examples liberally
reference the roles.  

I seems quite reasonable to define the following basic strings: "user",
"participant", ""moderator", "administrator", "observer" and add
appropriate text that the use of the roles is subject to policy (system
specific) and is FFS.  The default would be "user".  I can't see that
this would cause any harm.  I do fully agree that in the end we need
flexibility and extensibility for the role definition and that in terms
of effective use, we need to associated policy work completed.

Mary.  

-----Original Message-----
From: Oscar Novo [mailto:[email-masked]] 
Sent: Wednesday, December 05, 2007 12:28 PM
To: XCON-IETF
Subject: [XCON] Roles in the data model

Comments?

Oscar

---

From: "Oscar Novo" <[email-masked]>
Date: Wed, 5 Dec 2007 20:09:00 +0100

That's true. Normally a role is a bunch of permissions but still I think
we can use the decimals to sort the fuzzy combinations. For instance,
the first digit could identify the general role and the other digits
could identify particular permissions. 

Using your example and supposing A and B has the same general role, the
example could be something like: 

General_Role.PermissionX.PermissionY

(A role) 3.5.4 -> A has more permissions upon X than B
(B role) 3.4.5 -> B has more permissions upon Y than A

That's an idea. One of the problems with this idea is, if we have
thousend fuzzy permissions, we'll have thousend and one digits per role.
Maybe is it too complicated? 

Oscar

-----Original Message-----
From: Lorenzo Miniero [mailto:[email-masked]] 
Sent: 5. joulukuuta 2007 20:58
To: Oscar Novo
Cc: XCON-IETF
Subject: Re: [XCON] Roles in the data model

I'm not sure an integer like that would solve the problem... A might
have more permissions upon X than B, but B might have more permissions
upon Y than A. It surely works if we consider that participant <
moderator < administrator, but there could be fuzzy roles in between.

Lorenzo

Dipartimento di Informatica e Sistemistica Universit degli Studi di
Napoli "Federico II"

---

From: [email-masked]
Date: Wed, 05 Dec 2007 23:29:21 +0100

Hi Mary/all,

I would like to jump into the discussion once again, by pointing you  
to an old message I posted to the list in March:

http://www1.ietf.org/mail-archive/web/xcon/current/msg01919.html

The mail was all about roles and policies in XCON. I would like to  
know your feeling about my proposal.

Cheers,

Simon

-- 
                             _\\|//_
                             ( O-O )
    ~~~~~~~~~~~~~~~~~~~~~~o00~~(_)~~00o~~~~~~~~~~~~~~~~~~~~~~~~
                     Simon Pietro Romano
               Universita' di Napoli Federico II
                  Computer Science Department
         Phone: +39 081 7683823 -- Fax: +39 081 7684219
                 e-mail: [email-masked]

     <<Molti mi dicono che lo scoraggiamento è l'alibi degli
    idioti. Ci rifletto un istante; e mi scoraggio>>. Magritte.
                          oooO
    ~~~~~~~~~~~~~~~~~~~~~~(   )~~ Oooo~~~~~~~~~~~~~~~~~~~~~~~~~
                           \ (    (   )
                            \_)    ) /
                                  (_/

---

From: "Mary Barnes" <[email-masked]>
Date: Wed, 5 Dec 2007 16:53:19 -0600

Hi Simon,

Thanks for the reminder.  I had one important note that the "CAMEL" that I had in my charts yesterday was refering to the XACML in the referenced message (for the folks that were having an AIN anxiety attack). 

Perhaps, I mis-interpreted this thread, but I read the following in the thread to mean that the roles weren't defined by this model and the model still relied on roles defined in the data model with policy around that based on you example following this text:

  " That's all. With these policies in place, acess to the (XCON data model...)
conference object should be appropriately controlled.
Coming to the issue of assigning users to roles, which is BTW outside the scope
of an XACML Policy Decision Point (PDP), can be done through
so-called role-assignment policies. Such assignment should be under the
responsibility of an ad-hoc dedicated Role Assignment entity."

I was viewing role as a necessary input or index to the policy, but something would still live in the conference object (i.e., the role is a pointer to the necessary policy data (reflected by the  associated with this specific role).  

Mary. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, December 05, 2007 4:29 PM
To: Barnes, Mary (RICH2:AR00)
Cc: Oscar Novo; XCON-IETF
Subject: RE: [XCON] Roles in the data model

Hi Mary/all,

I would like to jump into the discussion once again, by pointing you to an old message I posted to the list in March:

The mail was all about roles and policies in XCON. I would like to know your feeling about my proposal.

Cheers,

Simon

Quoting Mary Barnes <[email-masked]>:

> I think at a minimum we should at least be defining <roles> in the 
> same manner that was done in the SIP conference event package:
>
> 5.6.3.  <roles>
>
> specifications" referenced in RFC 4575 yet we aren't able to define 
> some reasonable strings.
>
> In addition, not defining roles in the basic data model is 
> inconsistent with the framework where we define role as the following 
> and state that a default role will always exist:
>
> appropriate notes that roles are entirely defined in the policy 
> solution which is FFS. But, I think that leaves some fairly large 
> conceptual gaps in the framework, particularly given that the examples 
> liberally reference the roles.
>
> I seems quite reasonable to define the following basic strings: 
> "user", "participant", ""moderator", "administrator", "observer" and 
> add appropriate text that the use of the roles is subject to policy 
> (system
> flexibility and extensibility for the role definition and that in 
> terms of effective use, we need to associated policy work completed.
>
> Mary.
>
> I still don't see the utility to define some tokens in the data model. 
> I really think the definition of those roles will depend very much of 
> the definition of the policy in the data model. If the data model 
> defines a bunch of tokens without defining the semantic of them it can 
> cause big confusion for many reader. The definition of those tokens 
> will have implicit a semantic. For instance, the token 'observer' has 
> a semantic implicit but I'm sure that semantic differs from different people.
>
> My proposal here is to work on this problem in the policy document or 
> in a different document. If we decide to work in a different document 
> there is a very old document
> (http://tools.ietf.org/id/draft-morgan-xcon-roles-00.txt) which tries 
> to define the role semantic in XCON. I think that document could be a 
> base to start discussing about roles rather than the data model.
>
> data model I would suggest the definitions of the roles to be 
> numerical rather than textual to avoid semantic conflict. The roles 
> definition could be only simple integers starting from '0', having the 
> '0' role more permissions than the '1' role.
>
> Comments?
>
> Oscar
>
>

---

From: "Oscar Novo" <[email-masked]>
Date: Thu, 6 Dec 2007 00:33:34 +0100

Hi Simon,

I checked this document quiet many time ago when you sent it first time to the list. I always thought it was a good document and many of this work could be adopt in the XCON WG.
However, what we're dicussing here is if it's good to define a standard set of roles value in the data model or not. IMO that's not appropiate now because that definitions will be very dependent to the conference policy will define in the future. 

And as a matter of fact, I've checked again the "Core and hierarchical role based access control (RBAC) profile of XACML v2.0" document and section 4.1 says the following: 

"The set of roles is very application and policy domain-specific, and it is very important that different uses of roles not be confused. For
these reasons, this profile does not attempt to define any standard set of role values, although this profile does recommend use of a common AttributeId value... It is recommended that each application or policy domain agree on and publish a unique set of AttributeId values, ... that will be used for the various roles relevant to that domain".

Cheers,

Oscar 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 6. joulukuuta 2007 0:29
To: Mary Barnes
Cc: Oscar Novo; XCON-IETF
Subject: RE: [XCON] Roles in the data model

Hi Mary/all,

Cheers,

Simon

---

From: [email-masked]
Date: Thu, 06 Dec 2007 00:57:29 +0100

Oscar/Mary,

>
> And as a matter of fact, I've checked again the "Core and   
> hierarchical role based access control (RBAC) profile of XACML v2.0"  
>  document and section 4.1 says the following:
>
> "The set of roles is very application and policy domain-specific,   
> and it is very important that different uses of roles not be   
> confused. For
> these reasons, this profile does not attempt to define any standard   
> set of role values, although this profile does recommend use of a   
> common AttributeId value... It is recommended that each application   
> or policy domain agree on and publish a unique set of AttributeId   
> values, ... that will be used for the various roles relevant to that  
>  domain".

This is exactly what I stated in my e-mail. The example I sent indeed  
contained also a definition of roles ("creaor" and "user", also with  
role restrictions) made through the AttributeId values. I hope this  
clarifies the point raised by Mary in her e-mail.

I'm willing to help with this stuff in case the group thinks this  
might be the right direction to follow.

Simon

---

From: "Oscar Novo" <[email-masked]>
Date: Thu, 6 Dec 2007 00:55:59 +0100

Mary,

The data model does define roles in the same manner than RFC4575. As
well, the data model defines extra role elements. What I meant is that
we should not define the semantic of the roles now because this will
depend pretty much of the conference definition policy. 

Moreover, if we decide to define the semantic of the roles later any
change has to be done to the framework. 

Oscar

-----Original Message-----
From: Mary Barnes [mailto:[email-masked]] 
Sent: 5. joulukuuta 2007 21:09
To: Oscar Novo
Cc: XCON-IETF
Subject: RE: [XCON] Roles in the data model

5.6.3.  <roles>

Then in the schema:
     <!--
         USER ROLES TYPE
      -->

Mary.  

-----Original Message-----
From: Oscar Novo [mailto:[email-masked]]
Sent: Wednesday, December 05, 2007 12:28 PM
To: XCON-IETF
Subject: [XCON] Roles in the data model

Comments?

Oscar

---

From: "Mary Barnes" <[email-masked]>
Date: Fri, 7 Dec 2007 09:23:45 -0600

Oscar,

Okay. I thought you had been proposing that we delete the roles
altogether.  My concern in the previous versions of the document was
around trying to define the hierarchy, especially with the "observer"
role. 

I would still prefer that we define some basic strings and make the
element extensible.  At a minimum, we do need to define a default value
for the role to be consistent with the definition in the framework. 

Thanks,
Mary.  

-----Original Message-----
From: Oscar Novo [mailto:[email-masked]] 
Sent: Wednesday, December 05, 2007 5:56 PM
To: Barnes, Mary (RICH2:AR00)
Cc: XCON-IETF
Subject: RE: [XCON] Roles in the data model

Mary,

Oscar

-----Original Message-----
From: Mary Barnes [mailto:[email-masked]]
Sent: 5. joulukuuta 2007 21:09
To: Oscar Novo
Cc: XCON-IETF
Subject: RE: [XCON] Roles in the data model

5.6.3.  <roles>

Then in the schema:
     <!--
         USER ROLES TYPE
      -->

Mary.  

-----Original Message-----
From: Oscar Novo [mailto:[email-masked]]
Sent: Wednesday, December 05, 2007 12:28 PM
To: XCON-IETF
Subject: [XCON] Roles in the data model

Comments?

Oscar