RE: LDAPv3 Replication Access Control Design Team Report

[John McMeeking <jmcmeek@xxxxxxxxxx>]

Mike,

I believe your reply addresses authentication of servers to each other in
replication.  I think that is a separate issue from LDUP requirements or
behavior with respect to ensuring (or enabling) clients have the same
authroity to access data on each of multiple replicas.  The latter issue is
what this report addresses.


John  McMeeking



                                                                                                                                       
                      "Liben, Michael                                                                                                  
                      (GTS)"                   To:       Timothy Hahn/Durham/IBM@IBMUS, ietf-ldup@xxxxxxx                              
                      <mliben@exchange.        cc:                                                                                     
                      ml.com>                  Subject:  RE: LDAPv3 Replication Access Control Design Team Report                      
                      Sent by: owner-                                                                                                  
                      ietf-ldup@mail.                                                                                                  
                      imc.org                                                                                                          
                                                                                                                                       
                                                                                                                                       
                      09/10/2002 08:27                                                                                                 
                      AM                                                                                                               
                                                                                                                                       
                                                                                                                                       




I believe the security issues to be a business/technical problem that falls
outside of the replication protocol. There are other mechanisms required to
ensure that a server is trusted. The replicator
always has the option of not replicating with an untrusted partner.

Mike

-----Original Message-----
From: Timothy Hahn [mailto:hahnt@xxxxxxxxxx]
Sent: Tuesday, September 10, 2002 8:19 AM
To: ietf-ldup@xxxxxxx
Subject: RE: LDAPv3 Replication Access Control Design Team Report



Hi all,

Since "silence" seems not to be an option in this case, I'll log my opinion
here as siding IN FAVOR of the proposed work program.

My reasoning here is that I feel that
a) something needs to be done with respect to maintaining the security
around information access, even when that information is subject to being
replicated across a heterogeneous set of servers
b) mandating any one particular access control model implementation is (as
has been noted) a "rat hole" that is too deep and slimy to be productive
c) a mechanism for identifying an access control model + agreement that,
within an area of replication, a single access control model is applied is
a good way to "isolate" this problem from the main LDUP tasks of defining a
replication model (wire flows, data formats, administrative actions).

By isolating the problem, we can "agree to disagree" (as a collective
group) and still make progress on a replication protocol.  The approach
will also allow for those that CAN come to some agreement on an access
control model to be able to employ LDUP mechanisms.

I think that inserting this "level of indirection" with respect to access
control model frees up the LDUP WG to concentrate on replication flows
instead of being "stuck" as it has been for quite some time.

Regards,
Tim Hahn

Internet: hahnt@xxxxxxxxxx
Internal: Timothy Hahn/Durham/IBM@IBMUS
phone: 919.224.1565     tie-line: 8/687.1565
fax: 919.224.2540