Subject: Re: [Netconf] xml access control vs. netconf access control

From: "Andy Bierman" <[email-masked]>
Date: Tue, 09 Nov 2010 16:33:35 +0800

Hi,

IMO generic requirements are not useful.  The LDAP solution is specific to that type of server.

What specific netconf problems does the ldap solution address? Does it provide a CRUDX operation model like we need?  Does it integrate with radius? What specific requirements are met which netconf is reinventing?

Andy

----- Reply message -----
From: "Ladislav Lhotka" <[email-masked]>
Date: Tue, Nov 9, 2010 16:03
Subject: [Netconf] xml access control vs. netconf access control
To: "Andy Bierman" <[email-masked]>
Cc: <[email-masked]>

On Po, 2010-11-08 at 20:24 -0800, Andy Bierman wrote:
> On 11/08/2010 07:32 PM, Ladislav Lhotka wrote:
> > On Út, 2010-11-09 at 01:20 +0100, Juergen Schoenwaelder wrote:
> >> Hi,
> >>
> >> Bert mentioned today that we should look into XML access control work
> >> and see if/how this applies to NETCONF. One often cited XML access
> >> control piece of work is XACML defined by OASIS [1]. There has been
> >> a paper on how to use XACML for NETCONF [2]. There has also been
> >> some academic work where they decided against XACML [3].
> >>
> >> Of course, the NETCONF ACM applies to the NETCONF configuration
> >> database and to operations invoked by NETCONF; the ACM does not apply
> >> to the XML serialization used on the wire. NETCONF is not an XML
> >> database - it is a protocol that just happens to use XML to encode
> >> messages.
> >
> > XML is not just the serialized form. I assume the NETCONF database has
> > to be modelled (at least conceptually) as XML infoset because we use
> > XPath to query it etc.
> > ll
> 
> There are corner cases where a NETCONF server may not support all XPath
> expressions the same way, as documented in the YANG Usage Guidelines.

My point is that a NETCONF database in fact looks and behaves pretty
much like XML and the mapping to serialized XML is straightforward, so I
think "NETCONF is not XML" in not a valid reason for rejecting XACML
(though I don't advocate it because I haven't read the spec).

> 
> > This is not to say that XACML is of any use. On the other hand, access
> > control models of other hierarchical databases such as LDAP could be
> > considered.
> 
> 
> We are using XPath to specify the data rules.
> We have optimizations that address specific NETCONF operational requirements.
> 
> The easy part is specifying an ACL.
> The hard part is specifying the procedures a server must follow
> so that the same ACL on 2 different servers produces the same NETCONF
> protocol behavior.

Right, and I reckon LDAP servers must have implemented solutions to some
of these problems.

Lada

> > Lada
> Andy

-- 
Ladislav Lhotka, CESNET
PGP Key ID: E74E8C0C