Subject: [Geopriv] AW: Common policy identities clarification

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 1 Aug 2005 12:20:30 +0200

hi markus, 

thanks for your comments. please find my response below:

> Hi,
> 
> I've just read the recent mails about common policy identity 
> handling and also the relevant section of the -05 draft, and 
> want to know if I have understood everything correctly.
> 
> 1. <any-identity> is defined separately from <identity>. Is 
> there a particular reason for doing this in the current way, 
> as opposed to defining <any> as a subelement of <identity>, 
> while keeping <any>'s semantics equal to how <any-identity> 
> is currenctly defined? I think that the "hierarchical" option 
> would be easier to understand.

you would like to the following:

 <?xml version="1.0" encoding="UTF-8"?>
   <ruleset xmlns="urn:ietf:params:xml:ns:common-policy">

     <rule id="f3g44r2">
       <conditions>
         <identity>
           <any/>
         </identity>
       </conditions>
     </rule>
   </ruleset>

instead of :

 <?xml version="1.0" encoding="UTF-8"?>
   <ruleset xmlns="urn:ietf:params:xml:ns:common-policy">

     <rule id="f3g44r2">
       <conditions>
         <any-identity/>
       </conditions>
     </rule>
   </ruleset>

i have no problem with it since it does not semantically change
anything. 

> 
> 2. Section 7.1 states that "a rule with no conditions matches 
> any subscription irrelevant whether an authenticated or an 
> unauthenticated was used by the WR to access the resources". 
> I suppose this would be equal to a rule with
> 
> <conditions>
>   <any-identity/>
> </conditions>
> 
> Is this correct? (I don't think this is a problem as such, 
> but maybe worth pointing out in the text.)

that's true. 

> 
> (In any case I suppose the word identity is missing from the 
> sentence: "...irrelevant whether an authenticated or an 
> unauthenticated IDENTITY was used ...".)

the entire sentence should read: 

   1.  A rule with no conditions matches any subscription irrelevant
       whether the WR was authenticated or unauthenticated when
accessing the resource.

> 
> 3. I assume that based on the current draft it is possible to 
> define a rule which applies to every identity except 
> [email-masked] by doing this:
> 
> <rule id="abc123">
>   <conditions>
>      <any-identity>
>         <except-domain domain="example.com"/>
>      </any-identity>
>      <identity>
>        <domain domain="example.com"/>
>          <except entity="joe"/>
>      </identity>
>   </conditions>
> </rule>
> 
> This means that you can essentially do the notorious 
> black-lists per identity (remembering that the black-listed 
> identities must not get the permission through some other 
> rule either), only you have to do it in a pretty complicated 
> way... The side effect of this type of condition seems to be 
> that now any unauthenticated id (in addition to joe) from 
> "example.com" would not match the rule either. Right? This is 
> not a major problem, but obviously having exceptions not only 
> for domains but for individual ids would make this easier. 
> Was there some reasoning why domain exceptions are good but 
> id exceptions bad? 

you point to an important aspect. 
the have a section that evaluates the final result of a rule evaluation
in section 10. 
however, we haven't described what happens with cases you listed above.
this needs to be added. 

> 
> Finally, there is probably a typo in section 7.1 in guideline 
> 3.3. (which deals with <except-domain> under <any-identity>). 
> I believe "MUST" should be replaced with "MUST NOT".

i couldn't find this one. 

ciao
hannes

> Regards,
> 	Markus

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Aki Niemi <[email-masked]>
Date: Mon, 01 Aug 2005 15:28:25 +0300

Hi,

>>but maybe worth pointing out in the text.)

This is not according to my interpretation. It also doesn't make sense: 
how can an empty and a non-empty condition be equal?

A rule with no condition matches any request even if no identity was 
provided; a rule with no *identity* condition matches regardless of the 
identity. In other words, other conditions will determine whether the 
rule applies.

This bit...

<conditions>
    <identity>
       <any/>
    </identity>
</conditions>

...then again only matches requests that have an asserted identity. Does 
not matter which identity, as long as it is asserted and exists.

Cheers,
Aki