[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Access control
Randy Presuhn wrote:
Hi -
From: "Balazs Lengyel" <balazs.lengyel@ericsson.com>
To: "Andy Bierman" <ietf@andybierman.com>
Cc: "Vincent Cridlig" <vincent.cridlig@loria.fr>; "'Netconf (E-mail)'" <netconf@ops.ietf.org>
Sent: Monday, September 18, 2006 8:43 AM
Subject: Re: Access control
...
Does this mean, that in your opinion it is NOT Possible to do access control without the
information: what is stored already in the datastore?
...
Yes, for the example you gave.
This is a direct consequence of the way edit-config merge
is defined, and of the of access control requirement to distinguish
creation of an object instance from the modification of an objects'
attributes.
This depends on the "operation" and how that is represented
in the access control model.
If you wanted a model that uses the NETCONF operation set
(merge, replace, edit, delete) then you have to look at the
datastore during validation at some point anyway to process
an <edit-config> PDU already.
If your access control operation set is simply (read, write)
then you do not need to look at the datastore to enfore access
control.
Randy
Andy
--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>
--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>