Subject: [yaco-liaison-tool] From Field in Liaison Tool

From: Alexa Morris <[email-masked]>
Date: Fri, 28 Jan 2011 07:36:06 -0800

Henrik, everyone,

We have another question about something in the tool. When Stephanie,  
as the liaison administrator, uploads a liaison, the tool makes it  
look like the liaison is FROM her, see here: https://datatracker.ietf.org/liaison/991/ 
.    While the liaison is from THE IETF, if it is also going to be  
tied to a person there it should be tied to the person who sent in the  
liaison OR a generic IETF address that comes to us. Does that make  
sense?

Alexa

-----------
Alexa Morris / Executive Director / IETF
48377 Fremont Blvd., Suite 117, Fremont, CA  94538
Phone: +1.510.492.4089 / Fax: +1.510.492.4001
Email: [email-masked]

Managed by Association Management Solutions (AMS)
Forum Management, Meeting and Event Planning
www.amsl.com <http://www.amsl.com/>

---

From: "Emilio A. Sánchez López" <[email-masked]>
Date: Mon, 31 Jan 2011 14:08:02 +0100

Hi everyone,

    In the "Liaison Statement Management Tool Enhancements" statement of 
work the point 2.6.1 says:

"""
The “From:” field: The leadership of all recognized IETF entities will 
have accounts on the tool. (Please see Section A.1 in the Appendix.) 
When the submitter logs on to the tool, if the submitter represents a 
single IETF entity (e.g., a WG), then the “From:” field will include the 
name of the entity that the submitter represents, followed by the
submitter’s name in parenthesis, e.g.,

IETF CCAMP WG (Adrian Farrel)

If the submitter represents multiple entities (e.g., is a chair of two 
or more WGs), then the “From:” field will provide a drop-down list of 
these entities, and the submitter can select the appropriate one for the 
current liaison statement.

The submitter’s name will be a link to a “mail-to” form that will be 
pre-populated with whatever address is inserted into the “Reply-To:” 
field of the form. Initially, the “Reply-To:” field will be 
pre-populated with the submitter’s e-mail address. However, the field
will be editable, so that he or she can replace that address with 
another address in cases where it is appropriate for responses to go to 
another individual.
"""

    So, the tool always add the submitter name after the entity name but 
allows you to change the email address that submitter name points to.

    When submitting a Liaison on behalf of the IETF you can not avoid 
that "Stephannie McCammon" (or the name of the person logged into the 
tool) appears between parenthesis after "The IETF", but you can change 
the address it points using the reply-to field.

    Regards,

El 28/01/11 16:36, Alexa Morris escribió:
> Henrik, everyone,
>
> We have another question about something in the tool. When Stephanie, as
> the liaison administrator, uploads a liaison, the tool makes it look
> like the liaison is FROM her, see here:
> https://datatracker.ietf.org/liaison/991/. While the liaison is from THE
> IETF, if it is also going to be tied to a person there it should be tied
> to the person who sent in the liaison OR a generic IETF address that
> comes to us. Does that make sense?
>
> Alexa
>
> -----------
> _______________________________________________
> yaco-liaison-tool mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/yaco-liaison-tool

-- 
Emilio A. Sánchez
[email-masked]

---

From: Alexa Morris <[email-masked]>
Date: Mon, 31 Jan 2011 08:24:01 -0800

Hi Emilio,

Makes sense. Unfortunately, I think this is going to pose a real  
problem for us. IETF Secretariat is not leadership, we just upload  
liaisons on behalf of them on occasion. Stephanie (or any other member  
of the Secretariat team) should not be listed as a submitter. To use a  
somewhat flawed comparison, that would be a bit like giving the  
postman credit for the nice Christmas card that your friend wrote you.

Until we can determine how to address this, we are going to revert to  
using the old tool.

Thanks,
Alexa

On Jan 31, 2011, at 5:08 AM, Emilio A. Sánchez López wrote:

>   Hi everyone,
>
>   In the "Liaison Statement Management Tool Enhancements" statement  
> of work the point 2.6.1 says:
>
> """
> The “From:” field: The leadership of all recognized IETF entities  
> will have accounts on the tool. (Please see Section A.1 in the  
> Appendix.) When the submitter logs on to the tool, if the submitter  
> represents a single IETF entity (e.g., a WG), then the “From:” field  
> will include the name of the entity that the submitter represents,  
> followed by the
> If the submitter represents multiple entities (e.g., is a chair of  
> two or more WGs), then the “From:” field will provide a drop-down  
> list of these entities, and the submitter can select the appropriate  
> one for the current liaison statement.
>
> field of the form. Initially, the “Reply-To:” field will be pre- 
> populated with the submitter’s e-mail address. However, the field
> another address in cases where it is appropriate for responses to go  
> to another individual.
> """
>
>   So, the tool always add the submitter name after the entity name  
> but allows you to change the email address that submitter name  
> points to.
>
> that "Stephannie McCammon" (or the name of the person logged into  
> the tool) appears between parenthesis after "The IETF", but you can  
> change the address it points using the reply-to field.
>
>   Regards,
>

-----------

---

From: Glen <[email-masked]>
Date: Mon, 31 Jan 2011 08:32:39 -0800

Hi Emilio -

The statement of work is technically correct, but it looks like 
somewhere a case was not taken into account:

The secretariat staff, to use your phrasing, represents ALL entities 
(i.e. should be given all access to all properly-defined functions in 
the program.)  They can and should be able to perform all legitimate 
actions that ANY user of the system could perform - as though they were 
that user - whilst logged in as themselves - without having to log in as 
a different user to accomplish that.

This is a global requirement for anything IETF-wide that is written, I 
am guessing that was not spelled out clearly in the SOW, which is why 
this didn't happen.  So somehow we're going to need to get that 
functionality added... and make sure that it is spelled out in future 
contracts clearly.

Henrik -

How do you suggest we proceed?

Glen

On 1/31/2011 5:08 AM, "Emilio A. Sánchez López" wrote:
> When submitting a Liaison on behalf of the IETF you can not avoid that
> "Stephannie McCammon" (or the name of the person logged into the tool)
> appears between parenthesis after "The IETF", but you can change the
> address it points using the reply-to field.
>
> Regards,
>

---

From: "Emilio A. Sánchez López" <[email-masked]>
Date: Mon, 31 Jan 2011 18:28:45 +0100

Hi Glen.

    I'll understand that secretariat staff has to be able to perform any 
action on the system. However, the fact that they can impersonate any 
user does not seem a good idea. In that case you will not be able to 
know if the user X made some change of was a staff user impersonating X. 
But this is only my opinion :)

    I see in other parts of the idtracker that the secretariat staff can 
access some features but always as their user. For example, they can add 
comments to a draft, but they can not add a comment as if they were 
another person. Henrik knows the tool better than myself so correct me 
if I'm wrong.

    I think that are mainly two options to address this. One, as you 
said, is to make sure that this requirement is spelled out and then each 
new tool developed will need to allow a user from secretariat act as any 
other user.

    And two, modify the auth system so any secretariat user will be able 
to "jump" from one user to another and perform actions as this user 
transparently to the system. This has the advantage that old code will 
work properly and new code don't need to implement any special functions 
to allow that change for the secretariat members. The disadvantage, of 
course, is that the system will log actions as the "fake" member instead 
of the secretariat user.

    Leaving aside this second option, in the case of the liaison tool I 
see some ways of solving the issue:

    * Allow to edit the name of the submitter when the user is in the 
secretariat group placing a text input.
    * Allow to select the submitter when the user is in the secretariat 
group placing a select box.
    * Inserting a previous view in which the secretariat member selects 
which user he/she wants to impersonate.

    Regards,

-- 
Emilio A. Sánchez
[email-masked]

---

From: Glen <[email-masked]>
Date: Mon, 31 Jan 2011 10:03:35 -0800

Hi Emilio -

> But this is only my opinion :)

Unfortunately, that turns out not to be the case.  We have many 
situations in which IETF leaders expect us to be able to do things "on 
their behalf" - including cast and/or clear ballot positions, post 
comments, etc.

> another person. Henrik knows the tool better than myself so correct me

Where such situations exist, that is a deficiency that should be 
corrected - and where those situations exist, I generally have to go in 
to the database by hand to "fix" the record(s) in question.  And those 
deficiencies in no way change the fact that IETF leaders expect us to be 
able to do those things, whether right or wrong, alas.

> I think that are mainly two options to address this. One, as you said,
> is to make sure that this requirement is spelled out and then each new
> tool developed will need to allow a user from secretariat act as any
> other user.

Agreed.  The secretariat needs to be more involved in the review of all 
the IETF contracts that go out; alas, such is outside of my purview, but 
I hope those in command will consider this going forward.

> And two, modify the auth system so any secretariat user will be able to
> "jump" from one user to another and perform actions as this user

That sounds a bit overwhelming from a usage standpoint, but I will defer 
to others on that.

> Leaving aside this second option, in the case of the liaison tool I see
> some ways of solving the issue:

Thank you for taking the time to reply.  It looks like Alexa also 
replied to you (I didn't see that when I sent my reply) so it sounds 
like she and you have this well in hand.

Best,
Glen

---

From: Glen <[email-masked]>
Date: Mon, 31 Jan 2011 12:16:40 -0800

Hi again everyone -

> But this is only my opinion :)

Just to clarify -

I am certainly not in favor of impersonation.  I am very much in favor 
of accountability, since that protects all parties in all directions.

It should always be the case that it is noted that someone has taken an 
action on behalf of someone else; however, in most cases today the 
database doesn't support this.

I do not want users to have to log in as other users.  I do not want 
people sharing passwords.  That indeed is what I'm trying to AVOID here.

The IETF leadership and community expects the secretariat to be able to 
act on their behalf whenever necessary.  The secretariat requires this 
ability in order to do their jobs.  But as I said previously this needs 
to be addressed more clearly going forward, and that will either be done 
in the form of separate secretariat tools, or in the form of more 
specifics in the contract.  Everything I've said up to here is just 
general stuff, for the future, not about this project.

As far as this project specifically, Emilio, I do not personally expect 
or ask you to take, nor do I necessarily think that you *should* take 
any action here.  I am just trying to help bracket and identify the 
problem here so we can avoid it going forward.  I apologize that I 
failed to make that clear.

For now, our [the secretariat's] plan is to do what we always planned to 
do, which is that, for the moment, we will continue to use the old tool 
as needed, and, going forward, we had already planned to, and will, 
upgrade the secretariat tools we currently use to support whatever new 
functionality your product added.

I appreciate the detail you've sent us in the email, and your 
participation with the IETF on this project.

Best,
Glen