Subject: [Ietf-krb-wg] Goals of a data model: before we adopt a schema document

From: Sam Hartman <[email-masked]>
Date: Wed, 28 Oct 2009 10:11:16 -0400

Folks, we're hopefully reasonably close to being done with our
informational model and we have a charter item to create an LDAP-based
data model.  We also have a candidate document that presumably will be
presented for us to consider adopting to meet that charter goal.

However I think we need to have clarity surrounding what our goal for
the data model is; I think that needs to happen before we adopt a
document.  Most IETF management protocols have a standardized way of
managing a fairly small subset of the managed information in a
protocol.  For example our MIBs allow you to turn on and off an
interface on a router, but not in general to perform the operations of
creating a new virtual interface.

The idea is that there are some interopreable management and
monitoring tools you can write, but a number of operations will need
to use vendor-specific tools.

The informational model we've written is consistent with the IETF
management philosophy.  The goal was to be able to create common
administrative tools for handling a lot of common operations like
creating a principal with reasonably default attributes and displaying
a lot of the important information about a principal for monitoring.
However the informational model is not adequate to write fully
functional interoperable implementations of kadmin so that vendor A's
kadmin can manage vendor B's database sufficiently that you'd never
need to use vendor B's kadmin.  Similarly it is completely out of
scope for the informational model to be able to take a vendor A
database and use it with a vendor B KDC.

I support a data model with the same scope as the informational model.

However it sounds like there are a few people in the working group who
want a broader scope for the data model. For example there has been an
effort to collect all the attributes needed by the MIT and Heimdal
LDAP schemas, looking at things like tldata.

I don't support that broad of a data model within the IETF.  I think
that there are good reasons we don't attempt a management scope that
broad for other efforts and I think they apply to Kerberos as well.
One example is that I think the Kerberos community needs more
innovation; we have one relatively large vendor with significant
market share and some other smaller vendors.  I believe that those
vendors need to have significant flexibility to try something new,
differentiate themselves, etc.  Many of the areas where I think you
could do that involve extensions to the KDC data model.

That's certainly not the only reason the IETF has gone down the path
of reasonably limiting standardized data models.  The other reason is
that vendors represent things differently and gain value from these
different representations.

I'm not saying that the current informational model is perfect.
Perhaps it's missing some things that people need.  If so, I'd like to
start with a use case for what interoperable management task an
administrator wants to perform and examine whether the information
model has the necessary management objects to perform that task.

In conclusion, as part of adopting an LDAP schema draft I'd like to
limit its scope to a specific information model.  I do believe that
vendors should be encouraged to look at how to adopt what their doing
to this model.  For example I think it would be great if vendors
mapped all their attributes so they could fit in vendor-specific
extensions to the standard data model. 
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg