Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Date: Thu, 24 Mar 2016 15:52:13 +0100 (CET)
From: fabien@apache.org
To: httpd-dev <dev@httpd.apache.org>
Subject: Re: [VOTE] access control for dynamic hosts
In-Reply-To: 
 <CAKQ1sVMiqT2_6Yi6T=-4DFZMzAW-zd8XeRM_tY1d6cA61Br92A@mail.gmail.com>
Message-ID: <alpine.DEB.2.10.1603241543000.28700@sto>
References: <alpine.DEB.2.10.1512200931040.29581@sto>
 <alpine.DEB.2.10.1601140936560.28426@sto>
 <CAKQ1sVM-cr8GvJYsbHVL9W1kvttxnrz8toRj-=6acvu8_t7Fgw@mail.gmail.com>
 <alpine.DEB.2.10.1603011545040.18133@sto>
 <CALK=YjOv-3FxaSULNF5myB_E5S=Pun=p-113sucVO+RsQ1UC4w@mail.gmail.com>
 <alpine.DEB.2.10.1603060800330.11128@sto>
 <alpine.DEB.2.10.1603091742580.25393@sto>
 <CAKQ1sVOTT55LVYt_PSUQq5wT1WWobSRgULUNGY8bwjL7C9_Z0A@mail.gmail.com>
 <alpine.DEB.2.10.1603211337110.11011@sto>
 <CAKQ1sVMiqT2_6Yi6T=-4DFZMzAW-zd8XeRM_tY1d6cA61Br92A@mail.gmail.com>
User-Agent: Alpine 2.10 (DEB 1266 2009-07-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed


Hello Yann,

> I guess this question is for me, not the doc :)

Yep!

> [...] So, finally, mentioning that *any* ip/host-based authz should be 
> combined with other authz/authn (SSL certificates, credentials schemes, 
> ...) for stronger requirements may be the way to go.

I agree that combining authz is the way to go, esp. with sensitive 
applications which are more and more hosted outside of organizations, or 
even provided as SaaS.

I'm not sure of a good place to discuss authorization policies in general 
in the documentation though.

> Or maybe simply not change the doc since all this might be quite obvious...

I would be fine with this solution:-)

-- 
Fabien.