Re: Access control [was: action RPC I-D]

["Randy Presuhn" <randy_presuhn@mindspring.com>]

Hi -

> From: "Andy Bierman" <ietf@andybierman.com>
> To: "Andy Bierman" <ietf@andybierman.com>; "Balazs Lengyel" <balazs.lengyel@ericsson.com>; "Martin Bjorklund" <mbj@tail-f.com>;
<netconf@ops.ietf.org>
> Sent: Thursday, November 02, 2006 8:52 AM
> Subject: Re: Access control [was: action RPC I-D]
...
> > The maximum access that makes protocol sense is IMHO not an input to
> > isAccessAllowed - there is no runtime decision to make. The maximum
> > access that makes protocol sense is input for the tools that drive
> > your implementation; there simply is no write method to call for
> > read-only objects. In the SNMP processing, you return an error before
> > you ever get to the isAccessAllowed() function if I remember things
> > well.
>
> The maxAccess check could also be part of validation phase at runtime.
> The implementation aspects are not really important here.
...

If the order in which the checks are performed could affect what
error code is returned on the wire, then this *does* matter.

Randy



--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>