Subject: Re: authorization draft

From: Tatyana Ryutov <[email-masked]>
Date: Fri, 10 Sep 1999 15:51:49 -0700

Hi Veselin,

Thank you for your interest.

Veselin Terzic wrote:

> Hi Tatyana,
>
> I was reading the draft document that you wrote
>
> draft-ietf-cat-gaa-cbind-01.txt

> and I'm trying to see how is this project going.

The drafts have been updated, the latest versions are:

http://search.ietf.org/internet-drafts/draft-ietf-cat-acc-cntrl-frmw-02.txt
http://search.ietf.org/internet-drafts/draft-ietf-cat-gaa-cbind-02.txt

>
>
> How is it related to DASCOM's authorization API (http://www.dascom.com )?

In contrast to the GAA, AZN API includes credential management and
serialization interfaces.

I think the AZN API can be layered on top of the GAA for the credential
management purposes, however I do not see a clear reason for calling AZN
for checking if some operation is allowed, this is supported by the GAA.

One of the AZN objective is "Hide authorization attribute details, such
as groups, roles and clearance levels from the programmers", however
the API has explicit calls to obtain privileges from credentials
(azn_get_entitlements()) classification labels (azn_get_labels()) and
checking
clearance (azn_has_clearance()).
So, in implementing multi-level policy, separate calls have to be made,
whereas the
GAA API handles it transparently within just one call.

>
>
> Is there any implementations of GAA yet?

Yes.The GAA API  has been integrated with several applications:

1) Globus project  (http://www.globus.org) . The GAA is used to implement
trust constraints  on CA signature.  The GAA API code is a part of
the Globus distribution.
 Now we are working on adding the GAA to support policies for
services that a Globus user can invoke (e.g. ssh) and any additional
constraints,
e.g. a user A can use service B only if average system load is <N.

2)We've integrated the GAA with a mail filtering system to support
user-defined
policies on mail delivery.

3) Work is underway in integrating GAA with a system that supports static
and
dynamic groups. GAA is used for setting up group membership policies .

4) We are investigating possibility of layering GAA on top of Akenti
distributed
access control system.

> Thank you.
>
> --
> Veselin Terzic                        Phone: 650-425-5215
> DHL Systems Inc.                      Fax:   650-425-5018
> 700 Airport Blvd., Suite 300          Email: [email-masked]
> Burlingame, CA 94010                  #include <std/disclaimers.h>

Please let me know if you have any further questions.

Regards, Tanya

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]