RE: Access control

["David B Harrington" <dbharrington@comcast.net>]

Hi,

In SNMP, the permissions are based on a tree of data; data tends to be
statically defined and low-level.

In netconf, the permissions will be based on RPC methods; RPC methods
are dynamic high-level sets of functionality. The functionality may
actually call other methods within the system, so "create vlan" may
actually also manipulate an interface. The VLAN methodas may be
defined as part of one capability, while the interface may be part of
another capability. 

Should the ACM assume that permission to "create vlan" implies
permission to "manipulate interface"?

Dbh



--
to unsubscribe send a message to netconf-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/netconf/>