Subject: RE: AW: [Geopriv] AW: Common policy identities clarification

From: [email-masked]
Date: Thu, 4 Aug 2005 13:04:51 +0300

Hi,

Comments inline.

> -----Original Message-----
> From: Aki Niemi [mailto:[email-masked]]
> Sent: 04 August, 2005 11:58
> To: ext Tschofenig, Hannes
> Cc: Isomaki Markus (Nokia-TP/Espoo); [email-masked]
> Subject: Re: AW: [Geopriv] AW: Common policy identities clarification
> 
> 
> Hi,
> 
> ext Tschofenig, Hannes wrote:
> >> A rule with no condition matches any request even if no identity
> >> was provided;
> > 
> > authenticated or unauthenticated.
> > 
> > there is no concept of 'no identity provided'.
> > 
> >> a rule with no *identity* condition matches regardless of the 
> >> identity.
> > 
> > authenticated or unauthenticated.
> 
> Well, yes, but it need not be spelled out. Just like you 
> don't say that
> if the validity element is missing, the rule applies to all requests
> received since "the beginning of time" until "the end of the world".
> 
> If there is no identity condition, *any* value -- including NULL -- is
> allowed for the identity of the request. In my humble 
> opinion, that is.
> 

At least it sounds logical that all the conditions are treated equally, so that Identity does not become a special case. Currently the draft says

   A rule in a rule set might have a number of
   conditions which need to be met before executing the remaining parts
   of a rule (i.e., actions and transformations).

which would mean that if there is no Identity condition at all, a rule matches regardless of what the identity is, or whether it is even provided in the request.

> >> In other words, other conditions will determine whether the rule
> >> applies.
> > 
> > hmm. i am missing something here.
> 
> Ok, just like if the <conditions> contains no sphere 
> condition; then the
> request is matched based on other conditions (validity, identity) --
> regardless of whether sphere was provided, or what its value was.
> 
> The same principle should apply to identity, and be spelled out.
> 
> >> This bit...
> >> 
> >> <conditions> <identity> <any/> </identity> </conditions>
> >> 
> >> ...then again only matches requests that have an asserted identity.
> >> 
> > 
> > 
> > we defined it as 'matches only authenticated identities."
> > 
> > (asserted identities are treated as authenticated 
> identities with the
> > recent draft version.)
> 
> That's fine as well, as long as we're consistent.
> 

I suppose there has been at least rough consensus on that common-policy will not make a distinction between (end-to-end) authenticated and (third party) asserted identities, so I agree.

> >> Does not matter which identity, as long as it is asserted and
> >> exists.
> > 
> > 
> > most issue we discuss are a matter of definitions and style. we
> > should discuss these things intensively in order to finish it soon.
> 
> Definitely agree. I'm also willing to provide text for the 
> identity (and 
> the conditions chapters) if necessary.
> 
> Cheers,
> Aki
> 
> > ciao hannes
> > 
> > 
> >> Cheers, Aki
> >> 
> > 
> > 
> 

Markus

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv