Subject: RE: [ldapext] information on access control

From: Gil Kirkpatrick <[email-masked]>
Date: Thu, 21 Nov 2002 02:44:24 -0700

You might check into the SAML (Security Assertion Markup Language) at
oasis-open.org. LDAP vendors seem to be gravitating to DSML and SAML.

-gil

-----Original Message-----
From: Leif Johansson [mailto:[email-masked]] 
Sent: Wednesday, November 20, 2002 11:43 AM
To: Shari Galitzer
Cc: [email-masked]'
Subject: Re: [ldapext] information on access control

Shari Galitzer wrote:
> Hi,
> 
> I'm trying to find some information on current efforts to specify
> standards for access control for LDAP directories.  I see access control 
> is an area being worked on but cannot find any information.  Can you 
> point me to some information?
> 

There is only one individual draft submission from Steven Legg on
use of X.500 acl. Other than that, no work is beeing done (to my
knowledge).

draft-legg-ldap-acm-admin-01.txt
draft-legg-ldap-acm-bac-01.txt
draft-legg-ldap-admin-00.txt

	MVH leifj

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext
_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: George Robert Blakley III <[email-masked]>
Date: Thu, 21 Nov 2002 11:49:26 -0600

Shari,

Here's the complete list of access control standards I've personally been
involved in.

Open Group aznAPI (you can view HTML free but have to pay for .PDF):

      http://www.opengroup.org/publications/catalog/c908.htm

OMG CORBAsecurity (contains access control interfaces; for a better
description buy my book "CORBA Security"):

      http://www.omg.org/cgi-bin/doc?formal/2002-03-11

OMG RAD (Resource Access Decision)

      http://www.omg.org/cgi-bin/doc?formal/2001-04-01

OASIS SAML (Security Assertions Markup Language); this isn't an access
control specification per se but allows
an authorization decision service to consume standard subject attribute
descriptions and produce standard tokens
stating its decision:

      http://www.oasis-open.org/committees/security/

=======================

The Grand-daddy of access control specifications is the ISO Access Control
Framework; no one with an interest
in access control should be without a copy of this (even though you have to
pay for it):

http://www.iso.org/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=18199&ICS1=35&ICS2=100&ICS3=1

You may also want to look at X.500 Access Control (though I think this
model has lots of problems; I can elaborate
off-list if you're interested); David Chadwick is my favorite source of
information on this topic

http://www.isi.salford.ac.uk/staff/dwc/Version.Web/Chapter.8/Chapter8a.htm

The actual specification is here:

http://www.itu.int/rec/recommendation.asp?type=items&lang=e&parent=T-REC-X.500-200102-I

Novell's NDS has an extremely powerful and flexible access control model;
Ed Reed (who often contributes
to this list) is a good source of information about it; I don't have a link
to a good description online.

Finally, you might want to take a look at the WebDAV access control model:

      http://www.ietf.org/internet-drafts/draft-ietf-webdav-acl-09.txt

--bob

Bob Blakley (email: [email-masked]   phone: +1 512 286-2240  fax: +1
512 286-2057)
Chief Scientist, Security and Privacy, IBM Tivoli Software

Rob Byrne - Sun Microsystems <[email-masked]>@ietf.org on 11/21/2002
03:40:47 AM

Please respond to [email-masked]

Sent by:    [email-masked]

To:    Shari Galitzer <[email-masked]>
cc:    "[email-masked]'" <[email-masked]>
Subject:    Re: [ldapext] information on access control

Shari,

I'm sure others will point you to any recent documents issued on this
(LDUP, Stephens's x.500 acl usage etc.).  The Open group also appears to be
dabbling in this area....

However to give you some perspective as a directory vendor...we feel that
the opportunity has been missed for standard LDAP acl and that the level of
inter-vendor integration/synchronization implied by a standard acl model
(and repl model) will more realistically be achived by meta
directory/directory proxy type solutions.

You will find discussions on this on this list's archive (eg.
subject: moving access control discussion to LDUP) or on the LDUP archive.

Rob.

Shari Galitzer wrote:

Hi,

I'm trying to find some information on current efforts to specify standards
for access control for LDAP directories.  I see access control is an area
being worked on but cannot find any information.  Can you point me to some
information?

Thanks a lot,
Shari Galitzer
Principal Security Engineer
Phone: 608-251-6414
Fax: 608-663-6332

Entrust/CygnaCom