Subject: AW: [Geopriv] AW: Common policy identities clarification

From: "Tschofenig, Hannes" <[email-masked]>
Date: Wed, 3 Aug 2005 19:08:31 +0200

hi aki, 

please find some comments below:

> -----Ursprüngliche Nachricht-----
> Von: Aki Niemi [mailto:[email-masked]] 
> Gesendet: Montag, 1. August 2005 14:28
> An: Tschofenig, Hannes
> Cc: [email-masked]; [email-masked]
> Betreff: Re: [Geopriv] AW: Common policy identities clarification
> 
> 
> Hi,
> 
> ext Tschofenig, Hannes wrote:
> >>2. Section 7.1 states that "a rule with no conditions matches 
> >>any subscription irrelevant whether an authenticated or an 
> >>unauthenticated was used by the WR to access the resources". 
> >>I suppose this would be equal to a rule with
> >>
> >><conditions>
> >>  <any-identity/>
> >></conditions>
> >>
> >>Is this correct? (I don't think this is a problem as such, 
> >>but maybe worth pointing out in the text.)
> > 
> > 
> > that's true. 
> 
> This is not according to my interpretation. It also doesn't 
> make sense: 
> how can an empty and a non-empty condition be equal?

it is a matter of definition. 

whatever we define in the next few weeks should should not change it every few weeks/months. 

> 
> A rule with no condition matches any request even if no identity was 
> provided;
authenticated or unauthenticated. 

there is no concept of 'no identity provided'. 

> a rule with no *identity* condition matches 
> regardless of the 
> identity.
authenticated or unauthenticated. 

> In other words, other conditions will determine whether the 
> rule applies.
hmm. i am missing something here. 

> 
> This bit...
> 
> <conditions>
>     <identity>
>        <any/>
>     </identity>
> </conditions>
> 
> ...then again only matches requests that have an asserted 
> identity.

we defined it as 'matches only authenticated identities." 

(asserted identities are treated as authenticated identities with the recent draft version.)

> Does 
> not matter which identity, as long as it is asserted and exists.

most issue we discuss are a matter of definitions and style. we should discuss these things intensively in order to finish it soon. 

ciao
hannes

> Cheers,
> Aki

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Aki Niemi <[email-masked]>
Date: Thu, 04 Aug 2005 11:58:11 +0300

Hi,

ext Tschofenig, Hannes wrote:
>> A rule with no condition matches any request even if no identity
>> was provided;
> 
>> a rule with no *identity* condition matches regardless of the 
>> identity.
> 

Well, yes, but it need not be spelled out. Just like you don't say that
if the validity element is missing, the rule applies to all requests
received since "the beginning of time" until "the end of the world".

If there is no identity condition, *any* value -- including NULL -- is
allowed for the identity of the request. In my humble opinion, that is.

>> In other words, other conditions will determine whether the rule
>> applies.
> 

Ok, just like if the <conditions> contains no sphere condition; then the
request is matched based on other conditions (validity, identity) --
regardless of whether sphere was provided, or what its value was.

The same principle should apply to identity, and be spelled out.

>> This bit...
>> 
>> <conditions> <identity> <any/> </identity> </conditions>
>> 
>> ...then again only matches requests that have an asserted identity.
>> 
> 
> 

That's fine as well, as long as we're consistent.

>> Does not matter which identity, as long as it is asserted and
>> exists.
> 
> 
> most issue we discuss are a matter of definitions and style. we
> should discuss these things intensively in order to finish it soon.

Definitely agree. I'm also willing to provide text for the identity (and 
the conditions chapters) if necessary.

Cheers,
Aki

> ciao hannes
>> Cheers, Aki