Subject: [Geopriv] Schema in common-policy-06 does not allow empty <identity/> element

From: Binu K S <[email-masked]>
Date: Wed, 16 Nov 2005 17:37:56 +0530

Hi,

The current schema in common-policy-06 has a restriction that the
identity element cannot be empty. As a result, documents containing
the <identity/> element (all authenticated and unauthenticated
identities) are not validating. The identityType definition should
have minOccurs="0" in the choice specification.

-Binu

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 16 Nov 2005 12:16:11 -0500

An empty identity element would imply all AUTHENTICATED identities, I 
think. Unauthenticated ones would not match.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Director, Service Provider VoIP Architecture   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: Binu K S <[email-masked]>
Date: Thu, 17 Nov 2005 14:23:38 +0530

Hi Jonathan,

Section 7.1.4.1 (Page 17) in common-policy-06 makes a distinction between

<identity/>

and

<identity>
  <many/>
</identity>

The first case matches all authenticated and unauthenticated
identities while the second matched authenticated identities.

-Binu

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 21 Nov 2005 10:12:58 -0500

Good point, yes I see that now. This is the text I had in mind:

> 7.1.1.  Overview
> 
>    The identity condition restricts matching of a rule either to a
>    single entity or a group of entitites.  Only authenticated entities
>    can be matched; acceptable means of authentication are defined in
>    protocol-specific documents.  As usual, if the <identity> element is
>    (or all its child elements are) omitted, identities are not
>    considered and, thus, the condition matches any user, authenticated
>    or not.

which I interpreted to mean that <identity/> itself effectively catches 
only authenticated identities.

Either way is fine, really, we just need to be sure its clear.

-Jonathan R.