Subject: Comments on the ACC-CNTRL-FRMW-02 document

From: Denis Pinkas <[email-masked]>
Date: Thu, 08 Jul 1999 17:48:57 +0200

Comments are in sequence along the text and not by order of
importance.

This document has been placed on the web server only very
recently. :-(

It provides a very long introduction which seems to advocate for
three APIs described in section 11, namely:

gaa_get_object_policy_info (11.1)

gaa_inquire_object_policy_info (11.2)

gaa_check_authorization (11.3)

However while the document states that "a brief description of
the *main* GAA API routines" is provided, the details of these
routines and the description of other (?) routines are not
provided.

gaa_get_object_policy_info appears to be implementation dependent
mandating a pointer to the application-specific authorization
database.

gaa_inquire_object_policy_info takes as an input the principal's
security context. The link with GSS-APIs should be mentioned. It
returns a list of authorized rights and corresponding conditions.
Calling what is returned a list of operations would be less
confusion.

gaa_check_authorization is using in an input parameter a GAA API
option structure which appears to have a bearing that is
implementation dependent thus prohibiting portability.

It is suggested to re-structure the document to focus an the APIs
and to really make sure that the model supports capabilities.
There is an attempt to go in that direction but it is not evident
that the goal has been reached at this time.

Denis

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]