Re: LDAP Access Control

[Sanjay.Jain@software.com (Sanjay Jain)]

Tim Howes wrote:

>
>
> QUESTION 1: Do you believe LDAPEXT should be trying to define
> requirements, framework, and/or a model for access control in
> LDAP directories?

Yes. All.

>
>
> QUESTION 2: Do you basically support the access control
> requirements draft (draft-ietf-ldapext-acl-reqts-00.txt)?

Yes.

Not sure if there is a requirement that LDAP ACLs should be mappable
to/from X.500 ACLs.  If not, then do we need such a requirement.

>
>
> QUESTION 3: Do you basically support the access control model
> draft (draft-ietf-ldapext-acl-model-00.txt)?

Not sure.

>
>
> QUESTION 4: Do you think we should adopt the X.500(1993)
> basic access control model as the starting point for the LDAP
> access control model?

I would prefer a simplified or subset of X.500 ACL model which meets
theLDAP ACL requirements.  LDAP and X.500 have so many similarities in
the
information model, why create another entirely different ACL model for
LDAP.

>
>
> QUESTION 5: Do you think we should specify only a framework
> for identifying access control models, and not define a
> single standards-track model for LDAP at this time?
>

I think we need both.

sanjay