Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (herse.apache.org: domain of
 gcaidd-directory-dev@m.gmane.org designates 80.91.229.2 as permitted sender)
To: dev@directory.apache.org
From: Stephane Bailliez <sbailliez@gmail.com>
Subject: Re: [Triplesec] Permissions, Roles and Groups
Date: Tue, 30 Jan 2007 15:16:36 +0100
Lines: 34
Message-ID: <45BF5344.5090009@gmail.com>
References: <45B8FEAE.6060307@apache.org>
	 <a1b4a6610701251126p75ac68ddt3e18ddd79cd123c6@mail.gmail.com>
	 <45B91570.1080502@apache.org>
 <a1b4a6610701252301uf16b2afs13493fa1b7e12b3e@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
In-Reply-To: <a1b4a6610701252301uf16b2afs13493fa1b7e12b3e@mail.gmail.com>
Sender: news <news@sea.gmane.org>

Ersin Er wrote:
>> > These can be extended to the following entities:
>> >
>> > Policies
>> >  Subjects
>> >  Rules
>> >  Conditions
>>
>> Where is this from? Is this SUN's commercialized names for things they
>> have in their access control manager?
> 
> Well, these are not only SUN's terminology but generic entity
> descriptors that needs to be provided by a powerful access control
> system.
> 
> What we call Users and Roles in Triplesec can be extended to the term 
> Subject.
> 
> We don't have anything like Rules, although we must have. We just use
> abstract strings as David said. But this is not for controlling access
> but for storing abstract permission information.
> 
> And Conditions are still a required property. Beyond selecting the
> subjects and resources, we may need to satisfy more conditions like
> Authentication Level, IP Address, LDAP Filter, Time etc.
> 
> These all are also proposed by NIST spec and XACML.

Good point.

A permission could indeed be temporal or subject to other bizrules.


-- stephane