RE: Basic Access Control for LDAP

["Steven Legg" <steven.legg@adacel.com.au>]

Ed,

Ed Reed wrote:
> One question from reading the drafts (for now) -
> 
> What constitutes a "user" for the purpose of ACI UserClasses 
> value allUsers?

In the first instance it is anyone/anything who manages to bind in,
regardless of their authorization identity, but it is qualified by
the AuthenticationLevel and whether a permission is being granted
or denied.

For a permission being granted:

1) If the AuthenticationLevel is "none" then allUsers includes everyone,
regardless of authorization identity, anonymous included.

2) If the AuthenticationLevel is "simple" then allUsers includes all
users who have authenticated with at least a user name and password.
Anonymous users and users who have not been authenticated are excluded.

3) If the AuthenticationLevel is "strong" then allUsers includes all
users who have authenticated with strong credentials, e.g digital
signatures. Anonymous users, unauthenticated users and password
authenticated users are excluded.

For a permission being denied, allUsers includes everyone,
regardless of authorization identity and authentication level.

Regards,
Steven