Re: access control issues

[Eliot Lear <lear@cisco.com>]

Andy,

Please see inline.

Andy Bierman wrote:
> We can say when and where access control must be applied, without
> specifying an access control model.  (IMO, without a model, we actually
> are choosing the "everybody has access to everything" model, which
> is known to be broken and obsolete.)

Yes, but nobody is saying that.  What we're saying is that we're not 
standardizing the model.  Depending on who you are I might let you 
change an interface or not.  I don't need to standardize a model to do 
that (although it may help from a robustness perspective).

> The document should say somewhere that access control (i.e., user's
> ability to access specific portions of particular configurations in
> particular ways) MUST be enforced, and error(s) returned (if needed),
> instead of other protocol, rpc, or application errors, that would
> otherwise be returned.
>
> For example, a user shouldn't be able to issue a <validate> command on
> the <candidate>, for config data for which that user has no access.

Arguably a user shouldn't be able to <validate> a <candidate> that was 
generated by a different user.

Eliot

--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>