Re: subjects in LDAP ACMs

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

It's my personal opinion that ACMs should be based upon
authorization identities and that controls based upon
other factors (authentication method (or level), IP
address, DNS name, etc) should be left to other administrative
mechanisms (such as those upon within the authentication
subsystem and those external to LDAP (topology enforcement
systems)).

The primary reason is simplicity.  While an extensible
ACM which supports multiple orthogonal access control factors
would be more flexible, it is also quite complex (to design,
implement, and use).

Hence, I think we should do as RFC 2820 suggests [with clarification]:
   U1.  When in doubt, simpler is better, both at the interface and in
   the implementation.

   U2.  Subjects MUST be drawn from the "natural" LDAP namespace; they
   should be DNs [or RFC2829 authzIds].

The suggested "non-factor subjects" are not drawn from the "natural"
LDAP name space.  They add unnecessary complexity to the interface
and its implementations.

Kurt