W3C home > Mailing lists > Public > w3c-dist-auth@w3.org > October to December 1997

RE: ACL Draft

From: Paul Leach <paulle@microsoft.com>
Date: Wed, 22 Oct 1997 12:13:21 -0700
Message-ID: <771E1FEEEE41D111A95900805FFE658712AD3B@RED-MSG-51.dns.microsoft.com>
To: Howard Palmer <hep@netscape.com>, "'Larry Masinter'" <masinter@parc.xerox.com>
Cc: Yaron Goland <yarong@microsoft.com>, "W3c-Dist-Auth (E-mail)" <w3c-dist-auth@w3.org>
The traditional way of dealing with this is instead to say that the
"who" can contain lots of internesting info, such as where you are
connecting from. In other words, if it matters (for secuyrity purposes)
that "who" connecting from home and "who" connecting from work, then
they are different "who"s -- i.e., they are different principals.

As such, this is all completely orthogonal from the ACL issue: we
explicitly said that the form of principal names is a matter for the
authentication mechanism, not for ACLs. If you want to include "where
from" information in principal names, that's fine, as long as you
propose an authentication mechanism that can securely verify such
information.

> ----------
> From: 	Larry Masinter[SMTP:masinter@parc.xerox.com]
> Sent: 	Wednesday, October 22, 1997 9:08 AM
> To: 	Howard Palmer
> Cc: 	Yaron Goland; W3c-Dist-Auth (E-mail)
> Subject: 	Re: ACL Draft
> 
> To put it another way, you'd like
> 
> >   The basic model for access control, informally expressed, is that
> >    who you are determines how you can access a resource....
> 
> to change, so that 
> 
>   the basic model for access control is that
>   who you are and where you're connecting from determines ...
> 
> Larry
> -- 
> http://www.parc.xerox.com/masinter
> 
Received on Wednesday, 22 October 1997 15:13:49 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 2 June 2009 18:43:44 GMT