Re: Access Control document

[Steve Kille <S.Kille@isode.com>]

Alan,

Thanks for making this suggestion.   It would seem to me that IF the X.500
access control meets the requirements (or meets most of them, and it is
clear that it can be adapted to meet most or all of the remainder) then
there is a very strong case for using it as:
  1) It is an open standard already supported by a number of vendors
  2) It is clearly a natural fit with LDAP, which is based on X.500
  3) It will save the contentious work of defining something from
     scratch.

I'd be interested to understand if anyone disagrees with this??  

It seems to me unlikely, given the extensive list of requirements,
that a specification for Access Control which meets this list of
requirements is going to be much simpler than the X.500 one.   I can
see a case for a very simple access control scheme, but this is just not
going to arise from this requirements list.

It seems to me that a useful piece of work would be to evaluate the
X.500 access control specification (probably including the recent X.500(1997)
work, which focussed on many security aspects, including extending
access control in a number of useful ways) to see how far it meets the
requirements that this group is developing.   It would be a nonsense
to use the X.500 specifications if they did not meet the requirements.

We need to find someone to undertake this evaluation?  Ideally, this
should be someone "neutral" whose commercial postion would not be
significantly be affected by this decision.   I appreciate that it may
be hard to find someone who is both neutral and able to do the work.



Steve Kille