Subject: CAT authorization interface work

From: [email-masked]
Date: Fri, 9 Jul 99 12:10:52 PDT

John,

I would suggest to extend the list of goals to include:

1) Support for integration of multiple mechanisms with applications for 
   the purpose of authorization :

   - ability to support alternative authentication of principals.

    The method of authentication to be used may be selected among several 
    heterogeneous mechanisms. However granted authorizations may depend on 
    the "strength" of the used method (different access control rights 
    correspond to different authentication type).

   - integration with existing access control mechanisms, e.g. POSIX/NT ACL
     
2) Standardizing the way applications define their security requirements. 

This provides the means for integration of local and distributed security 
policies and translation of security policies across multiple authorization
models.

3) A common API will facilitate authorization decisions for applications.

4) Common evaluation mechanism. 

This is something that has to be decided on: 
whether we want a common evaluation mechanism or the ability to plug-in 
alternative mechanisms.

Tatyana Ryutov

John Linn wrote:

CAT fanciers:

Our draft milestones call for making a determination by July on direction
and intent re progressing authorization interfaces within the group.  The
purpose of this message is to open a thread to discuss this topic, in the
hope that we can make significant progress in advance of the Oslo meeting.
(We're also due to make a similar determination on low-infrastructure
mechanisms; I'll plan to send a separate message to open a thread there as
well.) 

We currently have three Internet-Drafts within the WG concerned with various
aspects of authorization: draft-ietf-cat-acc-cntrl-frmw-01,
draft-ietf-cat-gaa-cbind-01, and draft-ietf-cat-xgssapi-acc-cntrl-03. While
discussion at our meetings has indicated interest in the area of
authorization, and we've established that the scopes of XGSS and GAA are
largely complementary, we've had very limited discussion of the topic or
drafts between meetings.  I don't believe that we have consensus to advance
any of these drafts at this time, or that we should initiate commitments
unless we're confident of ability to deliver corresponding results. 

Some goals have been suggested within the group as candidate requirements
for prospective CAT authorization interface work, including:

(1) Support for a useful level of portability by applications across diverse
authorization mechanisms, validated through multiple implementations;
provide a framework rather than defining or assuming a specific
authorization mechanism

(2) Ability to progress in a timely fashion, coordinated to support the
needs of other WGs concerned with authorization

(3) Ability to support POSIX/NT ACLs

(4) Ability to support distributed authorization server models

(5) Ability to support a broad range of applications

(6) Ability to support a broad range of authorization policies

I believe that the activities required to satisfy (1) and (2) would require
the active and coordinated commitment of several individuals within the
group, with roles including at least coordination, document editing, liaison
to other groups, and implementation to demonstrate viability. At this point,
I'd like to solicit discussion from group members in the following areas:

(a) comments on the importance of the candidate priorities cited above, or
suggestions for other candidates

(b) perceptions on the value and utility of prospective CAT-specified
authorization interfaces to the broader IETF community

(b) identification of individuals with motivation and ability to contribute
to prospective authorization work, and in what capacity or capacities

These points should help to inform the group's decision as to whether to
progress authorization interfaces within CAT and, if so, the form and scope
any interface definitions should take.  Thanks in advance for your thoughts.

--jl
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]