Subject: authorization (was: protocol-22 comments)

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 7 May 2004 21:16:28 +0200

Jim Sermersheim writes:
>>>>>Hallvard B Furuseth <[email-masked]> 3/9/04 7:20:19 AM
>>>>
>>> 4.2. Bind Operation

>>Here is a suggestion, though it's a bit long. Maybe the last sentence
>>should be dropped.
>>
>> Authorization is the decision of which access an operation has to
>> the directory. It may be affected by many factors, (...)
> 
> I like the change but it still seems too specific. How about:
>  
> Authorization is the process of enforcing policy while performing
> operations.

I prefer my variant of that sentence.  A lot of policy is not
authorization, e.g.:
  which bind methods and SASL mechanisms to allow,
  parts of the the password policy internet-draft,
  how to protect against denial of service attacks,
  server-side size/time limits,
  whether and when to time out idle connections.

The rest of your text is much better than my suggestion.

> Among other things, the process of authorization takes as
> input authentication information obtained during the bind operation
> and/or other acts of authentication (such as lower layer security
> services).

-- 
Hallvard