Subject: RE: [Geopriv] New draft: Location Object Authorization Policies

From: [email-masked]
Date: Tue, 2 Sep 2003 13:58:40 -0400

Hi all,

in Section 2.2. of the draft, you're referring to 
"Currently there is no provision in [XCAP-USAGE] to provide
   authorization for anonymous access to location information (e.g. by
   using tokens). A proposal will be described in a separate document."

Do I understand such "anonymous access to location information" as a kind of "on-the-fly" access 
for not previously defined parties that present a certain token for access? In this, has the work 
on said proposal for such "anonymous access" already started? This would need to address integration 
in XCAP but also the actual provisioning of the required information. 

BTW, this kind of access would also be of interest for presence information in general.

Regards,

Dirk

>-----Original Message-----
>From: ext Tschofenig Hannes [mailto:[email-masked]]
>Sent: Tuesday, September 02, 2003 11:12 AM
>To: [email-masked]'
>Subject: [Geopriv] New draft: Location Object Authorization Policies
>
>
>hi all, 
>
>as part of our geopriv interim meeting preparations we have 
>compiled a new
>draft. the draft is a joint effort of john morris, henning schulzrinne,
>jorge cuellar, james polk and myself. 
>
>you will find the draft at: 
>http://www.tschofenig.priv.at/drafts/draft-tschofenig-geopriv-authz-00.txt
>
>ciao
>hannes
>
>
>_______________________________________________
>Geopriv mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/geopriv
>

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 02 Sep 2003 21:08:46 -0400

Note that some such mechanisms already exist. On most systems, you can 
trivially create user accounts for Digest (SIP and HTTP) or (for HTTP) 
Basic authentication. If the anonymous user can obtain the user name and 
password (e.g., by having them mailed to them, put them on my business 
card or post them in the subway), he or she gets access. This requires 
no more revealing of personal information than signing up for a 
web-based email account.

Thus, I'm a bit confused by the whole notion of anonymous access. We 
need to be able to clearly distinguish this from existing notions.