Subject: Comments on Policy Terminology

From: Joseph Salowey <[email-masked]>
Date: Tue, 08 May 2001 10:05:08 -0700

The draft looks good, but there are a few areas that confuse me.

$policy request

I was a little confused by this definition, perhaps is would be good to add 
something like

"A policy request may also refer to the retrieval of policy rules 
pertaining to a specific situation."

This definition should probably user "policy server" instead of "policy 
service" to be consistent with other definitions.

$role

I find the third definition of a role confusing. Can a managed element be 
something that is accessing a resource such as a user? If it is then 
explicitly stating so may help clarify things.  If it isn't then I think 
the definition is missing something.

Additionally a role can be a dynamic characteristic.

$role combination

I also find role combination confusing especially "That determination may 
examine all applicable policy rules identified by the role combination, its 
sub-combinations and the individual roles in the combination, or may 
require that PRCs explicitly match the role combination specified for the 
managed element."

What does it mean for PRC's to explicitly match the role combination?

Perhaps this usage of role and role combination is implementation specific, 
do you have a reference in mind?

Thanks,

Joe

---

From: "Andrea Westerinen" <[email-masked]>
Date: Fri, 11 May 2001 14:56:20 -0700

Replies inline.
Andrea

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Joseph Salowey
Sent: Tuesday, May 08, 2001 10:05 AM
To: [email-masked]; [email-masked]
Subject: Comments on Policy Terminology

$policy request

<arw> How about this for a definition? (Anything in CAPS is added.) ...
      (P) A message requesting a policy-RELATED service. THIS MAY REFER
        TO A REQUEST TO RETRIEVE A SPECIFIC SET OF POLICY RULES, TO
        DETERMINE THE ACTIONS TO ENFORCE, OR OTHER POLICY REQUESTS.
        When sent by a PEP to a PDP, it is more accurately qualified
        as a "policy decision request." [R2753] (See also "policy
        decision.")

<arw> We don't use the term "policy server" since its meaning varies widely.
Please see our definition of this term.

$role

I find the third definition of a role confusing. Can a managed element be
something that is accessing a resource such as a user?

<arw> No.

If it is then

<arw> A person's Role is the first definition.  The third definition is the
use of an attribute called "Role" to label a rule.  A "Role" is also
assigned to entities such as devices, ports, interfaces, etc.  When the
"Role" on the rule and on the entity match, then it is assumed that the rule
is applicable to the entity.  This definition is used in SNMPCONF, PIBs and
the policy model.

<arw> Where it is restricted?

$role combination

<arw> PRCs do not allow sub-combinations of roles.  Let me rephrase the
sentence as (using CAPS for anything new) ...
        That determination may examine all applicable policy rules
        identified by the role combination, its sub-combinations
        and the individual roles in the combination. IN THE CASE OF
        PRCs, A PRC MUST EXPLICITLY MATCH THE ROLE COMBINATION OF
        THE MANAGED ELEMENT IN ORDER TO BE APPLICABLE AND/OR ENFORCED.

<arw> I will add a reference to the policy core model [RFC 3060].  The PRC
work is still an I-D.

Thanks,

Joe

---

From: Joseph Salowey <[email-masked]>
Date: Mon, 14 May 2001 10:28:34 -0700

Comments in line

Thanks,

Joe

>Please see our definition of this term.

This helps.

>is applicable to the entity.  This definition is used in SNMPCONF, PIBs and

I like the simpler role definition in RFC 3060, but I can see what you are 
trying to convey.  I think If you add a reference to RFC 3060 it will help 
greatly.

>         THE MANAGED ELEMENT IN ORDER TO BE APPLICABLE AND/OR ENFORCED.

This helps.

---

From: "Andrea Westerinen" <[email-masked]>
Date: Tue, 22 May 2001 00:00:15 -0700

It looks like we have consensus and I will add the reference to RFC3060 for
role.

Thanks.
Andrea

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Joseph Salowey
Sent: Monday, May 14, 2001 10:29 AM
To: Andrea Westerinen
Cc: [email-masked]; [email-masked]
Subject: RE: Comments on Policy Terminology

Comments in line

Thanks,

Joe

This helps.

This helps.